🔍 Read the full analysis: OpenSSH SSHole Bug: Key Details On Password Length And Server Risk on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
OpenSSH’s CVE-2026-123158 flaw can allow passwordless access to certain accounts on Linux systems using musl, without PAM, when password authentication is enabled. OpenSSH released version 10.6p2 on November 5, 2026; administrators should update and restart sshd or disable password logins while they cannot update.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a flaw that can let an attacker log in to certain accounts without a valid password on a limited set of Linux servers. The vulnerability, nicknamed “sshole” by its finder and rated 8.1, High, affects systems using musl’s C library when sshd checks passwords without PAM and password authentication is enabled.
The bypass depends on how OpenSSH’s sshd handles an error from the musl C library’s crypt() function. Alpine Linux’s advisory says that for a password longer than 256 bytes, musl returns an asterisk (*) as an error indicator. Some accounts that should not accept password logins have that same character in their stored password field. In the affected configuration, the failed password check can appear to match the stored value.
The advisory says an attacker can trigger the issue with a password between 257 and 1,024 bytes. It also lists a further condition: the system must have at least one local account with a $5$ or $6$ password hash. The flaw is not a general bypass of SSH authentication; all of the listed system and configuration conditions must be present.
Alpine Linux’s standard openssh-server package is the best-known affected case. Alpine says fixed packages are available across its branches, including older releases. Installing a package is not enough by itself: Alpine advises administrators to restart sshd so the running server uses the patched code. If an update is not immediately possible, the source advises setting PasswordAuthentication no and reviewing logs for password logins to accounts with a * password field.
OpenSSH SSHole Bug Password Length and Server Risk
CVE-2026-123158 can bypass password checks on a narrow set of musl-based Linux servers. Administrators should check exposure, patch, and restart sshd.
How the bypass works
On affected systems, musl’s crypt() can return an asterisk for an excessively long password, matching some accounts’ stored password field.
An attacker sends a password between 257 and 1,024 bytes.
musl returns “*”, which may match the stored field of an account that should not accept password login.
In the affected configuration, the failed password check can appear valid.
Check all five conditions
The flaw is not a general SSH authentication bypass; every listed condition must apply.
- Linux system uses musl.
- sshd checks passwords without PAM.
- Password authentication is enabled.
- An account has a “*” password field.
- At least one local account has a $5$ or $6$ password hash.
Where to look
Alpine Linux’s standard openssh-server package is the best-known affected case; embedded builds also merit review.
- Alpine Linux and other musl-based builds
- OpenWrt, Buildroot, and Yocto environments
- Embedded products with SSH enabled
- Ubuntu cites glibc and PAM
- Red Hat says its products are not affected
- Debian lists the issue as unimportant for its packages
Patch and reduce exposure
A package upgrade alone does not replace the running daemon.
Install the fix
Use OpenSSH 10.6p2 or the fixed package provided by your distribution.
Reload patched code
Restart sshd after installing the package so the running server uses the fix.
Disable password logins
If you cannot update yet, set PasswordAuthentication to no where operationally possible.
Check authentication logs
Look for suspicious password logins, especially to accounts with a “*” password field.
Risk to Musl-Based SSH Servers
The flaw matters because SSH is a common remote administration service, and a vulnerable server may be reachable over a network. The source reports that public exploit code appeared about four hours after the November 5 fix, citing GreyNoise and BleepingComputer. GreyNoise said it recorded a first successful break-in on one of its sensors about 40 hours after the release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9.
Those reports give administrators reason to check systems promptly, but they do not establish that every exposed server was attacked or that every musl-based device is vulnerable. The affected configuration is narrow. Alpine’s advisory also warns that an account able to log in may be able to gain root privileges through tools such as doas, so administrators should consider account permissions as well as direct root login settings.
Products Worth Considering
Sonos Arc Ultra Soundbar with Dolby Atmos, Black
DJI Mini 3 Drone with DJI RC and 3-Axis Mechanical Gimbal
DJI Mini 4 Pro Fly More Combo Drone with DJI RC 2
As an affiliate, we earn on qualifying purchases.
The Conditions Behind the Bypass
Alpine Linux describes five conditions that must coincide: Linux with musl; sshd checking passwords without PAM; PasswordAuthentication yes; an account whose password field is *; and at least one local account with a $5$ or $6$ hash. Alpine is the prominent example, while the researcher also identified OpenWrt, Buildroot and Yocto environments as areas to check.
The source says Debian, Ubuntu and Red Hat report their builds are not affected. Ubuntu attributes that status to its OpenSSH being linked against glibc and using PAM; Red Hat also says its products are not affected. The issue does not apply, according to the supplied advisories, to non-Linux systems, systems using glibc or PAM for the relevant check, servers with password authentication disabled, Dropbear, or containers that do not run sshd.
Responsibility for the underlying behavior is disputed. OpenSSH says the root cause is outside sshd but can be avoided there. Musl maintainer Rich Felker said he regards the issue as an erroneous use by the caller, while also indicating musl may change the mechanism in an upcoming release cycle. The researcher credited “agent swarms” with finding the bug; OpenSSH said AI agents can rediscover bugs sometimes within hours. Those comments describe the participants’ views, not a separate technical finding about the vulnerability.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.”
— Alpine Linux security advisory
Exposure Across Embedded Builds
The exact number of exposed systems is not established in the supplied material. While the conditions identify which configurations are at risk, administrators may not know whether a device uses musl, bypasses PAM for SSH password checks, or contains the relevant account and hash combination without checking its build and configuration.
Risk in embedded environments also remains less settled than for the named major distributions. Medcrypt said on the oss-security mailing list on November 9 that it reproduced the issue on a stock Yocto image without unusual configuration. The source does not establish how widely that result applies to Yocto-based products or whether affected vendors have issued updates. It also does not report the number of confirmed compromises beyond GreyNoise’s observation on one sensor.
Patch, Restart and Review Logs
Administrators should first determine whether affected systems meet the advisory’s conditions, then install OpenSSH 10.6p2 or a vendor-provided fixed package. After installation, restart sshd; Alpine specifically warns that the running daemon is not replaced merely by upgrading the package. Where patching must wait, disable password authentication if operationally possible and check authentication logs for suspicious access, particularly logins to accounts that should not have a usable password.
Owners of embedded devices should check with their operating-system or product vendors for a fixed package and confirm whether their builds use musl and the affected authentication path. Further updates may clarify the reach of the Yocto report, the status of other embedded builds and any changes musl makes to its error behavior. The supplied source does not identify a common release date for those possible follow-ups.
Key Questions
What is the OpenSSH SSHole flaw?
CVE-2026-123158 is a password-check bypass in a specific OpenSSH setup. On affected systems, an excessively long password can cause musl’s crypt() function to return *, which may match the stored field of an account that should not accept password login.
Which systems are affected?
All listed conditions must apply: Linux uses musl, sshd checks passwords without PAM, password authentication is enabled, an account has a * password field, and a local account has a $5$ or $6$ hash. Alpine Linux is the best-known affected case; the source also flags embedded environments for review.
Are Ubuntu, Debian and Red Hat affected?
The source says Ubuntu and Red Hat report their builds are not affected. Ubuntu cites its use of glibc and PAM. Debian’s tracker rates the issue “unimportant” for its packages and lists the fixed upstream version in its unstable branch.
What should administrators do now?
Install OpenSSH 10.6p2 or the fixed package for your distribution, then restart sshd. If you cannot update yet, disable password authentication where possible and review logs for unexpected password logins to accounts with a * password field.
Source: ThorstenMeyerAI.com
