🔍 Read the full analysis: OpenSSH SSHole Bug: Understanding The Linux Server Password Risk on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
OpenSSH’s SSHole flaw, tracked as CVE-2026-123158, can allow passwordless login on certain Linux systems using musl, without PAM, with password authentication enabled. OpenSSH released a fix in version 10.6p2 on November 5, 2026; administrators should update, restart sshd and review logs for suspicious password logins.
OpenSSH released version 10.6p2 on November 5 to fix a password-authentication flaw that can let attackers log in to certain Linux server accounts without a valid password. Tracked as CVE-2026-123158 and nicknamed “SSHole” by its finder, the bug affects a narrow set of systems using the musl C library without PAM, with password logins enabled; reports cited by the source say attackers began exploiting it after public code appeared.
The bypass depends on how OpenSSH’s server, sshd, checks passwords on affected systems. According to Alpine Linux’s advisory, musl’s crypt() function returns an asterisk when it receives an input key longer than 256 bytes. Some accounts that are not meant to accept password logins also have an asterisk in the password field. In the vulnerable configuration, the error value can match that field, allowing authentication to succeed. The reported attack uses an unusually long password, between 257 and 1,024 bytes.
Alpine says the system must meet several conditions for the bypass to work: Linux with musl, password checking by sshd without PAM, password authentication enabled, an account with an asterisk in its password field, and at least one local account with a $5$ or $6$ password hash. Alpine’s standard openssh-server package is a prominent example. The source also identifies some OpenWrt, Buildroot and Yocto deployments as possible cases, depending on their configuration.
The source reports that exploit code became public about four hours after the fix was released, citing GreyNoise and BleepingComputer. GreyNoise reportedly detected the first successful break-in on one of its sensors about 40 hours after release. CISA added the flaw to its exploited-vulnerabilities list on November 9. These reports indicate active exploitation, but do not establish how many servers were compromised.
OpenSSH SSHole Bug Linux server password risk
A narrow set of Linux configurations can allow passwordless SSH login. Administrators should verify exposure, install a fix and review authentication logs.
When the bypass can work
The affected conditions must coincide on the same host.
The system uses musl and sshd checks passwords without PAM.
The SSH server accepts password authentication.
An account has an asterisk in its password field, and a local account has a $5$ or $6$ hash.
Check the specific host
A distribution name alone cannot establish whether a server is exposed.
Libraries and settings
Check whether the host uses musl, whether PAM handles password checks, and whether password authentication is enabled.
Accounts and privileges
Look for asterisk password fields, qualifying local hashes and paths to greater privileges such as doas.
Build and vendor guidance
OpenWrt, Buildroot and Yocto systems may depend on their configuration. Consult the vendor and verify the actual build.
What operators should do
Patch and check for signs of access, including on systems that may have been exposed after deployment.
- Install a fixed OpenSSH package and restart sshd; upgrading alone may leave the running daemon in place.
- If a prompt update is not possible, consider setting PasswordAuthentication no if that fits access requirements.
- Review SSH logs for password logins to accounts with no password and unusual access after the fix became public.
- On Alpine tiny-cloud images, inspect the alpine account and doas permissions.
Why the Configuration Matters
The bug matters because SSH is a common route for administering servers remotely. On a vulnerable machine reachable over the network, a login bypass could give an attacker access to an account that would ordinarily reject password authentication. The potential impact depends on that account’s permissions and on what else the attacker can reach from the server.
Alpine warns that a vulnerable account may be able to obtain greater privileges through a separate mechanism. It gives passwordless doas as an example in some of its official tiny-cloud images. OpenSSH’s usual setting, PermitRootLogin prohibit-password, can limit direct root login, but it does not prevent an attacker from using another account that can become root. Administrators should check both SSH access and local privilege-escalation paths.
The incident also shows why the affected software and the exact configuration both matter. The source says Debian, Ubuntu and Red Hat builds are not affected, citing their advisories. That does not mean every Linux server is vulnerable, or that a distribution name alone can establish a server’s status. Operators need to verify the libraries, PAM use and authentication settings on the specific host.
Products Worth Considering
Apple Watch SE 3 GPS 40mm Smartwatch
Samsung Galaxy Tab A11+ (6GB RAM, 128GB Storage) – Gray
Logitech MX Ergo S Advanced Wireless Trackball Mouse USB-C – Graphite
As an affiliate, we earn on qualifying purchases.
How OpenSSH and musl Interact
The flaw arises at the boundary between OpenSSH’s password check and musl’s handling of an overlong input to crypt(). OpenSSH says it considers the root cause to be outside sshd, while also saying the issue is exploitable through sshd and can be avoided there. Musl maintainer Rich Felker, in a mailing-list message quoted by the source, described the issue as an erroneous use by the caller rather than a musl bug and said the mechanism may change in an upcoming release cycle.
Those positions describe different parts of the failure: the library’s error value and the way the caller compares it with a stored password field. The released OpenSSH fix is version 10.6p2. Alpine says it published fixed packages across supported and older branches, though administrators should confirm the package version available for their own release and follow its update instructions.
The source says systems using glibc, non-Linux systems, SSH servers that use PAM for password checks, systems with password authentication disabled, and systems running Dropbear are not affected by this particular flaw. Ubuntu says its OpenSSH is linked against glibc and uses PAM; Red Hat says its products are not affected. Debian’s tracker rates the issue “unimportant” for its packages and lists upstream version 1:10.6p2-1 as fixed in its unstable branch.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.”
— Alpine Linux advisory
Exposure and Attribution Still Vary
The source does not provide a count of vulnerable or compromised systems, and the reported sensor activity cannot establish the scale of attacks across the internet. Exposure depends on all of the listed conditions being present at once, so a Linux server’s operating system name alone is not enough to determine whether it is vulnerable.
There is also an unresolved disagreement over whether the underlying issue belongs to OpenSSH or musl. The source reports that Medcrypt independently reproduced the behavior on a stock Yocto image, but that report does not show how widespread exposure is across embedded devices or products. Operators of such systems should consult their vendor and verify the actual build and settings rather than assume they are covered by a major distribution’s assessment.
For some Alpine cloud images, Alpine says systems are safe on first boot but can become exploitable once a qualifying $6$ hash exists. The practical status of any individual machine therefore may change after deployment. The source also does not detail the full scope of the observed intrusions or confirm whether attackers used the flaw to access particular organizations.
Patch, Restart and Review Logs
Administrators should install a fixed OpenSSH package and restart sshd. Alpine explicitly warns that upgrading the package does not replace a daemon that is already running. Where an update cannot be applied promptly, the source recommends setting PasswordAuthentication no, provided that change fits the organization’s access requirements and does not lock out legitimate administration.
After patching, review SSH authentication logs for password logins to accounts that have no password, along with unusual access around the period after the fix became public. Check whether the host uses musl, whether sshd checks passwords without PAM, whether password authentication is enabled, and whether accounts with an asterisk coexist with qualifying local password hashes. For Alpine’s tiny-cloud images, also inspect the alpine account and doas permissions.
Organizations that cannot determine their exposure should ask their Linux or device vendor for build-specific guidance. Further updates may clarify the extent of exploitation, the status of embedded products and whether musl’s handling of the error value changes in a future release. Until then, the confirmed mitigation is to run a fixed OpenSSH build, restart the service and investigate relevant login activity.
Key Questions
What is the OpenSSH SSHole flaw?
CVE-2026-123158 is a password-authentication bypass in a limited Linux configuration. An overlong password can cause musl’s crypt() function to return an asterisk that may match the stored field of an account that should not accept password logins.
Which Linux servers are affected?
A server is potentially affected only when the required conditions coincide: Linux with musl, sshd checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and a local $5$ or $6$ password hash. Alpine’s standard openssh-server package is a known example, but administrators need to check each host’s configuration.
Are Debian, Ubuntu and Red Hat affected?
The source says the distributions’ advisories report their OpenSSH packages are not affected. Ubuntu cites its use of glibc and PAM, and Red Hat says its products are not affected. Debian’s tracker rates the issue as unimportant for its packages. Check the relevant distribution advisory for the system and package version in use.
How should administrators respond?
Install a fixed OpenSSH package, then restart sshd so the updated daemon is running. If an immediate update is not possible, disable password authentication where operationally appropriate and review logs for password logins to accounts that have no password.
Does the report confirm widespread compromise?
No. The source reports exploitation observed by a GreyNoise sensor and CISA’s addition of the flaw to its exploited-vulnerabilities list, but gives no total number of affected or compromised servers. The scale and targets of attacks remain unclear.
Source: ThorstenMeyerAI.com
