🔍 Read the full analysis: OpenSSH SSHole: The Server Risks Linked To Overlong Passwords on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
A flaw tracked as CVE-2026-123158 can let attackers log in to certain accounts on Linux servers using OpenSSH, musl and password authentication without knowing the account password. OpenSSH released a fix in version 10.6p2 on November 5, 2026; administrators should update and restart sshd or disable password authentication while they assess exposure.
OpenSSH has released version 10.6p2 to fix CVE-2026-123158, a high-severity flaw that can allow passwordless access to certain accounts on some Linux systems using musl. The bypass requires a particular combination of server settings and account records; it does not affect every OpenSSH installation, but public exploit code and reported successful exploitation make prompt checks and patching important for administrators.
The issue, called “sshole” by its finder, is rated 8.1, High, in the supplied report. It occurs when sshd checks passwords without PAM and the musl C library’s crypt() function receives an overlong password. Alpine Linux’s advisory says musl returns an asterisk (*) as an error indicator when the key exceeds 256 bytes. For accounts whose stored password field is also *, the failed password calculation can appear to match that field, allowing authentication to succeed.
The reported exposure depends on several conditions being present together: Linux with musl, password checking by sshd without PAM, password authentication enabled, an account with a * password field, and at least one local account with a $5$ or $6$ password hash. Alpine says a password between 257 and 1,024 bytes can trigger the issue. Its advisory says one connection can be enough; this is not a case that requires repeated password guesses.
OpenSSH released the fix on November 5. According to the source report, GreyNoise and BleepingComputer said exploit code appeared about four hours later, and GreyNoise recorded a first successful break-in on one of its sensors about 40 hours after release. CISA added the flaw to its exploited-vulnerabilities list on November 9. Those observations indicate exploitation activity, but do not establish how many servers or organizations have been compromised.
OpenSSH SSHole Server risks from overlong passwords
CVE-2026-123158 can bypass password checks on systems with a specific mix of Linux, musl, sshd settings, and account records. Administrators should verify exposure, patch, and restart the SSH service.
When exposure conditions align
The bypass requires the listed server settings and account records together.
Linux must use the musl C library.
sshd checks passwords without PAM, and password authentication is enabled.
An account has a * password field, and at least one local account has a $5$ or $6$ hash.
Why an overlong password can matter
The reported trigger is a password between 257 and 1,024 bytes.
- musl crypt() returns * as an error indicator for an overlong key.
- sshd compares that result with the account’s stored password field.
- For an account with a * field, the values can match.
- Authentication may succeed without the account password.
Scope depends on the build
Distribution names alone do not establish whether a system is affected.
| System or setting | Supplied report |
|---|---|
| Linux with musl and matching sshd/account conditions | Potentially exposed |
| glibc builds, PAM-based checks, or PasswordAuthentication no | Outside the described conditions |
| Dropbear or locked accounts marked with ! | Outside the described conditions |
| Embedded and custom Linux builds | Verify libc, sshd, PAM, settings, and account fields |
Act on the running service
Package installation alone does not replace the active daemon.
- Install OpenSSH 10.6p2 or a vendor-provided fixed package, then restart sshd.
- If patching must wait, disable password authentication and use another suitable access method.
- Review SSH logs for unusual password logins to accounts with * fields, and investigate suspicious access.
Exposure Depends on Server Configuration
The flaw matters most to administrators of Alpine Linux and other musl-based systems that expose SSH password logins. A compromised account may provide a foothold for further access, particularly if that account can gain elevated privileges. Alpine warns that blocking direct root password login does not protect a server if another accessible account can become root through a tool such as doas.
Alpine specifically identifies official tiny-cloud images from versions 3.18.11 through 3.24.3 as a risk after a $6$ hash exists on the machine: the images include an alpine account with a * password field and passwordless doas. The advisory says they are safe on first boot, but that state can change. This makes it important to check the server’s actual configuration and account database rather than relying only on the distribution name.
The reported scope is limited. The source says Debian, Ubuntu and Red Hat builds are not affected, citing differences such as glibc use or PAM-based authentication. That distinction helps teams prioritize, but it does not remove the need to verify embedded or custom Linux builds, where libc and SSH configuration may differ from mainstream distributions.
Popular right now
De’Longhi La Specialista Touch Semi-Automatic Espresso Machine with Grinder
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, White
Ninja Air Fryer XL with MaxCrisp, 6.5 Qt, 6-in-1, Dark Grey (AF181)
As an affiliate, we earn on qualifying purchases.
How musl and sshd Interact
In the affected configuration, sshd asks musl’s crypt() to calculate a password hash and compares the result with the account’s stored field. The failure value and the field used for some accounts with no password are both *. The reported bypass arises from that collision, rather than from discovering or cracking a valid password.
Responsibility for the underlying behavior is disputed. OpenSSH says the root cause is outside sshd, though it can be exploited through sshd and avoided there. Musl maintainer Rich Felker said on the project’s mailing list that he regards the problem as erroneous use by the caller, while indicating musl may change the mechanism in a future release cycle. The immediate protection described in the advisories is the OpenSSH update, not waiting for a change to musl.
The source report says non-Linux systems, Linux systems using glibc, PAM-based password checks, configurations with PasswordAuthentication no, and systems running Dropbear instead of sshd are outside the described conditions. It also says locked accounts marked with !, rather than *, cannot log in through this issue. These are scope statements from the supplied advisories, not a substitute for checking locally built or modified packages.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.”
— Alpine Linux advisory
Embedded Linux Exposure Still Varies
The full number of vulnerable or compromised servers is not given. GreyNoise’s reported sensor observation confirms a successful break-in on that sensor, but does not show the scale of attacks across the internet or identify affected organizations.
Exposure in embedded and custom-built systems remains harder to determine from the supplied information. The researcher named OpenWrt, Buildroot and Yocto among environments to examine, and Medcrypt reported on November 9 that it had reproduced the issue on a stock Yocto image. That report does not establish that every product using Yocto is affected; the relevant libc, sshd build, PAM use, authentication settings and account fields still need checking.
The supplied material does not detail the full contents of the fix, the number of patched installations, or whether any specific cloud images have been updated since the listed versions. It also does not establish whether musl will change its behavior in a later release. Administrators should use vendor advisories for their exact package and release.
Patch, Restart, and Review Logs
Administrators should install OpenSSH 10.6p2 or a vendor-provided fixed package, then restart sshd so the running service uses the patched code. Alpine says fixed packages are available across branches from edge back to 3.16, including releases no longer receiving regular updates. Its advisory gives apk upgrade -U -a as an update command and stresses that installing a package alone does not replace the active daemon.
If an update cannot be applied immediately, the supplied guidance is to set PasswordAuthentication no and use another suitable access method. Teams should check whether their systems meet all exposure conditions, review SSH authentication logs for unusual password logins to accounts with * fields, and investigate any suspicious access. CISA’s listing and distribution advisories may provide further status updates as vendors publish package-specific guidance.
Key Questions
Which systems are at risk from SSHole?
The reported flaw requires Linux with musl, sshd password checks without PAM, password authentication enabled, an account whose password field is *, and a local account with a $5$ or $6$ hash. Alpine is the best-known affected case in the source material.
Does SSHole affect Ubuntu, Debian, or Red Hat?
The supplied report says Ubuntu and Red Hat state their builds are not affected; it says Debian’s tracker rates the issue unimportant for its packages. Administrators should still check their vendor’s current advisory and their own build configuration.
What should an administrator do first?
Install OpenSSH 10.6p2 or the vendor’s fixed package, then restart sshd. If patching must wait, disable password authentication with PasswordAuthentication no and review logs for suspicious logins.
Does the flaw mean servers have been compromised?
No. The source reports exploit code and a successful login observed on one GreyNoise sensor, but gives no total count of compromised servers. A system’s presence in a potentially affected environment does not by itself prove it was vulnerable or breached.
Source: ThorstenMeyerAI.com
