🔍 Read the full analysis: OpenSSH “SSHole” Bug: An Overlong Password Opens Some Linux Servers, And Attackers Already Use It on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A flaw in OpenSSH can let an attacker log in to certain Linux accounts using an overlong password, but only when several specific system and configuration conditions are met. OpenSSH released a fix on Nov. 5, and CISA added the vulnerability to its exploited-vulnerabilities list on Nov. 9. Administrators should update, restart sshd and review authentication logs.
A flaw in OpenSSH can let attackers log in to some Linux accounts without a valid password by submitting an unusually long one, according to security advisories. The vulnerability, tracked as CVE-2026-123158 and nicknamed “SSHole” by its finder, affects systems using the musl C library under specific password-authentication configurations; OpenSSH released a fix, version 10.6p2, on Nov. 5.
The issue arises when OpenSSH checks passwords without the PAM login framework and uses the C library’s crypt() function. Alpine Linux’s advisory says musl returns an asterisk when a password exceeds 256 bytes. For accounts whose password field is also an asterisk, the error value can match the stored field, causing authentication to succeed. The reported attack uses a password between 257 and 1,024 bytes.
The bypass requires more than a long password. The affected server must run Linux with musl libc, check passwords without PAM, allow password authentication, have an account with an asterisk in its password field, and have at least one local account with a $5$ or $6$ password hash. Alpine’s standard OpenSSH server package is a prominent example of the relevant configuration. The advisory says one account with a real password hash can supply the salt used in the check.
OpenSSH released 10.6p2 on Nov. 5. GreyNoise and BleepingComputer reported that exploit code became public about four hours later, and GreyNoise said it recorded its first successful intrusion on a sensor about 40 hours after the release. CISA added the flaw to its catalog of exploited vulnerabilities on Nov. 9. These reports show exploitation was observed, but do not establish how many servers or victims were affected.
SSHole: When an Overlong Password Can Open a Linux Server
CVE-2026-123158 can bypass password checks on systems with a specific musl and OpenSSH configuration. A fix is available, and successful exploitation has been observed.
How the bypass works
In the affected setup, musl returns an asterisk for an overlong password. OpenSSH can mistake that error value for a match against an account field that also contains an asterisk.
An error looks like a match
The password check can treat musl’s asterisk error response as the stored value for an account with no password.
Several conditions must align
The server needs musl, password checks without PAM, password authentication enabled, an asterisk account field and a local $5$ or $6$ password hash.
Who should check
Alpine is a known example; custom and embedded builds may differ from standard distribution packages.
- Alpine Linux
- OpenWrt
- Buildroot
- Yocto images
- Ubuntu says its glibc and PAM builds are not vulnerable.
- Red Hat says its products are unaffected.
- Debian rates the issue unimportant for its packages.
Respond to the risk
Public exploit code appeared after the fix, and GreyNoise reported a successful intrusion on one sensor.
Check musl, PAM, password authentication, account fields and local password hashes.
Update OpenSSH to a corrected package, then restart the running sshd service.
Investigate unexpected password logins to accounts with no password.
Why SSH Servers Need Prompt Patching
The vulnerability matters because SSH is widely used for remote server administration, and an exposed server meeting all the conditions could allow account access without a correct password. An attacker who gains a login may also be able to reach higher privileges if the compromised account has a route to administrator access. Alpine warns, for example, that a root-login restriction does not protect a system if another accessible account can become root through a tool such as doas.
The impact is limited by the configuration requirements, and major Linux distributions say their standard builds are not affected. But the reported public exploit and observed successful intrusion make it important for administrators of Alpine and embedded Linux deployments to check their actual library, PAM, and SSH settings rather than assume a server is safe based on its distribution name alone.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
Vitamix 5200 Blender with 64 oz. Container, Black
Ninja Crispi Microwave & Air Fryer with FusionCrisp Technology, 14-in-1, Black (MW101BK1)
As an affiliate, we earn on qualifying purchases.
How the Asterisk Becomes a Match
On many Linux systems, an account that cannot authenticate with a password has an asterisk in its password field. Ordinarily, no password should produce a matching hash, so the account remains inaccessible through password login. In the affected setup, however, musl’s error response for an overlong password is also an asterisk. OpenSSH’s password check can then mistake that error value for a match against the account field.
Responsibility for the underlying behavior is disputed. OpenSSH said the root cause is outside its server code, though the problem can be avoided there. Musl maintainer Rich Felker said he viewed the issue as an erroneous use by the caller rather than a musl bug, while indicating the mechanism may change in a future release cycle. OpenSSH’s shipped patch addresses the vulnerable authentication path.
Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable; Red Hat also says its products are unaffected. Debian’s security tracker rates the issue unimportant for its packages and lists the fixed upstream version in its unstable branch. The source material identifies Alpine as the best-known affected case and names OpenWrt, Buildroot and Yocto as environments to check. A Medcrypt report on the oss-security mailing list said the flaw was reproduced on a stock Yocto image.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.”
— Alpine Linux security advisory
Which Deployments Remain Exposed
The affected population is not yet established. The vulnerability requires several conditions to coincide, and the supplied reports do not give a count of exposed systems, confirmed victims or successful attacks beyond GreyNoise’s observation on one sensor. Embedded and custom-built deployments may differ from standard distribution packages, so administrators will need to verify how their systems are configured.
It is also unclear from the available material how widely the issue has been exploited since the public code appeared. The dispute over whether the root cause lies in musl or in OpenSSH’s use of its return value remains unresolved, although OpenSSH has issued a server-side fix. Reports of the issue on Yocto indicate that stock or customized embedded images warrant checks, but do not establish that every Yocto device is vulnerable.
Update, Restart and Review Logs
Administrators should install the corrected OpenSSH package and restart the running sshd service; Alpine warns that upgrading a package alone does not replace an already running daemon. Alpine says fixed packages are available across its branches, including older releases. Where an update cannot be applied immediately, the source advises setting PasswordAuthentication no as a mitigation, if that is compatible with the server’s access requirements.
After patching or applying a mitigation, administrators should check SSH authentication logs for password logins to accounts that have no password, and investigate any unexpected access. Teams responsible for Alpine, OpenWrt, Buildroot or Yocto systems should verify whether all the listed conditions apply, including PAM use, the active password-authentication setting, account password fields and local password hashes. Further advisories or package updates may clarify affected configurations as maintainers review the issue.
Key Questions
What is the OpenSSH SSHole vulnerability?
SSHole is the nickname for CVE-2026-123158, a flaw that can allow passwordless access to certain accounts on Linux systems when an overlong password is checked through a specific musl and OpenSSH configuration.
Which systems are affected?
A system must meet several conditions: Linux with musl libc, OpenSSH password checks without PAM, password authentication enabled, an account with an asterisk in its password field, and at least one local account with a $5$ or $6$ hash. Alpine’s standard OpenSSH server package is a known example. Check the system’s actual configuration rather than relying only on its distribution name.
Are Ubuntu and Red Hat systems vulnerable?
Ubuntu says its OpenSSH builds use glibc and PAM and are not affected. Red Hat says its products are not affected. The supplied source also says Debian’s packages are not affected by the reported conditions.
How should administrators respond?
Install the fixed OpenSSH version or the distribution’s corrected package, then restart sshd. If an update is not immediately possible, disable password authentication where appropriate and review logs for password logins to accounts that should not accept passwords.
Has the flaw been exploited?
GreyNoise reported seeing a successful intrusion on one of its sensors about 40 hours after the OpenSSH fix was released. CISA added the vulnerability to its exploited-vulnerabilities list on Nov. 9. The available reporting does not establish the total number of affected systems or victims.
Source: ThorstenMeyerAI.com
