🔍 Read the full analysis: An Overlong Password Can Open Some Linux Servers Through SSHole on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A flaw tracked as CVE-2026-123158 can let an attacker bypass password checks on some Linux SSH servers by submitting an overlong password. It affects a narrow set of systems using musl without PAM, with password authentication enabled and specific account entries; OpenSSH released a fix in version 10.6p2 on November 5, 2026.
A flaw in OpenSSH can let attackers log in to certain Linux accounts without a valid password by submitting an unusually long one, according to advisories for CVE-2026-123158. The issue, dubbed “sshole” by its finder, affects a specific combination of musl-based Linux systems and SSH settings; OpenSSH released a fix, version 10.6p2, on November 5.
The bypass depends on how musl’s crypt() function handles an overlong password when OpenSSH checks passwords without PAM, a common Linux login framework. Alpine Linux says that when the supplied key exceeds 256 bytes, musl returns an asterisk (*) as an error indicator. On affected systems, that can match the asterisk stored for accounts without a usable password, causing the check to succeed instead of fail.
The reported conditions are narrow: the server must run Linux with musl, perform password checks without PAM, allow password authentication, and have an account whose stored password field is “*”. Alpine’s advisory also says the system must have at least one local account with a $5$ or $6$ password hash. The researcher identified Alpine as a prominent example and also named OpenWrt, Buildroot and Yocto systems as possible cases, depending on their configuration.
According to the source report, exploit code appeared about four hours after the fix was released, citing GreyNoise and BleepingComputer. GreyNoise reported seeing a successful break-in on one of its sensors about 40 hours after the release. CISA added the flaw to its list of exploited vulnerabilities on November 9. Administrators are advised to update OpenSSH and restart the server process; if an update is not possible, the recommended mitigation is to set PasswordAuthentication no and check logs for password logins to accounts without passwords.
SSHole: an overlong password can open some Linux servers
A flaw in OpenSSH can bypass password checks on a narrow set of musl-based Linux systems. Exposure depends on the server’s build, settings and account entries.
When the bypass can work
All listed conditions must apply; a distribution name alone does not confirm exposure.
The server uses musl for password checks.
OpenSSH checks passwords without PAM.
The SSH server accepts password authentication.
An account has “*” in its password field, and the system has a local account with a $5$ or $6$ hash.
How the check fails
On affected systems, an unusually long password can make the password check succeed instead of fail.
- An account marked “*” cannot authenticate with a password.
- An invalid password should be rejected.
- For a password over 256 bytes, musl returns “*” as an error indicator.
- That can match the stored field and allow login.
Check the actual configuration
Alpine is a prominent example; OpenWrt, Buildroot and Yocto systems may also be affected depending on their configuration.
| Configuration | Reported status |
|---|---|
| musl, no PAM, password login enabled, matching account conditions | Potentially affected |
| glibc, PAM-based password check, or password login disabled | Outside the listed conditions |
| Dropbear SSH server or non-Linux system | Outside the listed conditions |
Patch, restart and review
The fix is available in OpenSSH 10.6p2; follow your vendor’s package guidance.
- Install the fixed OpenSSH package.
- Restart sshd so the running service uses the update.
- If you cannot patch immediately, set PasswordAuthentication no, while maintaining access through another approved method.
- Review SSH logs for password logins to accounts with “*” in the password field and investigate unexplained entries.
Risk for Musl-Based SSH Servers
The flaw matters because a reachable SSH service is often an important gateway to a server. On systems that meet the listed conditions, an attacker may be able to access an account without knowing its password. Alpine says the bypass can occur in one connection and does not require repeated password guesses. If an affected account can use a privilege-escalation tool such as doas, access could lead to greater control of the machine.
The impact should not be generalized to all Linux servers. The source material says Debian, Ubuntu and Red Hat report that their OpenSSH builds are not affected, citing their use of glibc, PAM, or other package configurations. Systems using glibc, PAM-based password checks, disabled password authentication, or the Dropbear SSH server are also listed as outside the affected conditions. Administrators still need to check their own package and configuration rather than infer exposure from the operating system name alone.
The reports of public exploit code and a sensor-observed intrusion make prompt patching relevant for exposed systems. They do not, by themselves, establish how widespread exploitation is or whether a particular organization has been targeted. For operators of embedded devices, the issue also highlights the need to verify the actual SSH build and account configuration in deployed images.
Products Worth Considering
Bose TV Speaker (2nd Gen) Compact Soundbar
Samsung Galaxy Tab S7 11-inch Android Tablet 128GB Wi‑Fi with S Pen Mystic Black
Anker SOLIX C300 DC Portable Power Station with 60W Solar Panel, 288Wh, 300W
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
OpenSSH’s advisory says it considers the root cause to be outside sshd, while also saying the problem can be avoided in sshd. Musl maintainer Rich Felker disputed that framing on the musl mailing list, calling the behavior an erroneous use by the caller rather than a musl bug. Felker said musl may change the mechanism in an upcoming release cycle. The disagreement concerns where responsibility for the failure belongs; it does not change the need for affected operators to apply the OpenSSH fix.
The account condition is important. An asterisk in a password field is commonly used to mark an account as unable to authenticate with a password. Alpine says its official tiny-cloud images from versions 3.18.11 through 3.24.3 include an alpine user with such a field and passwordless doas. Those images are not described as vulnerable on first boot, but Alpine says they can become exploitable once a qualifying $6$ hash exists on the system. OpenSSH’s default setting, PermitRootLogin prohibit-password, does not necessarily protect a different account that can gain root privileges.
For the broader Linux landscape, the source material identifies several exclusions: non-Linux systems, Linux systems using glibc, systems that use PAM for the password check, and systems with password authentication disabled. Debian lists the issue as “unimportant” for its packages and identifies the fixed upstream version in its unstable branch. These statements are distribution-specific assessments, not a substitute for checking an individual server’s build and settings.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.””
— Alpine Linux security advisory
Exposure Depends on Local Configuration
The number of affected servers and the extent of exploitation are not established in the supplied material. GreyNoise’s reported observation concerns a successful break-in on one sensor; it does not show how many other systems were compromised. The five conditions also mean that identifying a system as Alpine, OpenWrt, Buildroot or Yocto is not enough by itself to confirm vulnerability.
Exposure in embedded deployments remains less clear. The source report says Medcrypt reported reproducing the issue on a stock Yocto image, but the extent to which that result applies across vendor products is not specified. The dispute between OpenSSH and the musl maintainer over where the root cause belongs also remains unresolved in the cited statements. Administrators should rely on their vendor’s advisory and inspect the running server’s package, authentication method and account fields.
Patch, Restart and Review Logs
Administrators should install a fixed OpenSSH package, then restart sshd so the running daemon uses the updated code. Alpine says it has published fixed packages across its branches, including older branches; package versions differ by branch, so operators should follow Alpine’s advisory for the appropriate release. Installing the package without restarting the service may leave the old daemon running.
If patching cannot be done immediately, disable password authentication by setting PasswordAuthentication no, provided that access can be maintained through another approved method. Operators should review SSH authentication logs for password logins to accounts whose password field is “*” and investigate any entries that cannot be explained. The supplied reports do not specify a universal detection signature or establish that every such login represents exploitation, so log findings require local review.
Further guidance may come from distribution and embedded-platform maintainers as they assess their builds. Operators should track those advisories and confirm that both the package update and the service restart have taken effect.
Key Questions
What is the SSHole vulnerability?
It is a password-authentication bypass tracked as CVE-2026-123158. Under particular conditions, an overlong password can trigger an error value in musl that matches the stored field for an account without a usable password.
Which systems may be affected?
Systems must meet several conditions described by Alpine: Linux with musl, OpenSSH checking passwords without PAM, password authentication enabled, a qualifying account field containing “*”, and at least one local $5$ or $6$ password hash. The operating system or project name alone does not confirm exposure.
Are Ubuntu, Debian and Red Hat affected?
The source material says Ubuntu and Red Hat reported their OpenSSH builds are not affected, while Debian rates the issue as unimportant for its packages. Administrators should consult their distribution’s current advisory and verify their own system configuration.
What should administrators do?
Install the fixed OpenSSH version available for the system and restart sshd. If an update is not immediately possible, disable password authentication and review logs for password logins to accounts without passwords.
Does the flaw affect every account or SSH server?
No. The reported bypass requires a specific combination of platform, authentication settings and account data. The supplied advisories list systems using glibc or PAM, systems with password authentication disabled, and Dropbear as outside the described conditions.
Source: ThorstenMeyerAI.com
