🔍 Read the full analysis: What Makes The OpenSSH SSHole Password Bug A Concern? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
OpenSSH’s CVE-2026-123158, dubbed SSHole by its finder, can allow passwordless access to certain accounts under a specific combination of Linux, musl and SSH settings. OpenSSH released version 10.6p2 on November 5, and GreyNoise reported a successful attack on a sensor about 40 hours later. Administrators should update and restart sshd, or disable password authentication if they cannot update.
OpenSSH released a fix for CVE-2026-123158, a high-severity password-authentication flaw dubbed SSHole that can let an attacker log in to certain accounts without knowing their password. The issue affects only systems meeting several conditions, including running Linux with the musl C library, using sshd without PAM, and allowing password logins; public exploit code appeared hours after the patch, and GreyNoise later recorded a successful intrusion on one of its sensors.
The flaw occurs when sshd checks a password without PAM and relies on musl’s crypt() function. According to Alpine Linux’s advisory, musl returns an asterisk (*) as an error indicator when a password input is longer than 256 bytes. Some accounts that should not accept passwords have an asterisk in the stored password field. In the affected configuration, the error result can therefore match that field and sshd can accept the login. The reported input range is 257 to 1,024 bytes.
The affected setup requires more than musl alone. Alpine lists five conditions: Linux with musl; password checking without PAM; PasswordAuthentication enabled; an account whose password field is an asterisk; and at least one local account with a $5$ or $6$ password hash. Alpine’s standard openssh-server package is a prominent example. The researcher also identified possible exposure in OpenWrt, Buildroot and Yocto deployments, but administrators need to check their actual builds and settings.
OpenSSH published version 10.6p2 on November 5. According to GreyNoise and BleepingComputer, exploit code became public about four hours later. GreyNoise said its sensor recorded a first successful break-in about 40 hours after the release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. These reports establish observed exploitation, but do not by themselves show how many systems were compromised or identify the operators.
Why the OpenSSH SSHole Bug Raises Concern
A password check can fail open on systems with a specific mix of Linux, musl and SSH settings. Exploitation was observed after a fix and public exploit code appeared.
How the password check fails
Without PAM, sshd can rely on musl’s crypt() behavior when checking a password.
Inputs from 257 to 1,024 bytes trigger musl’s error marker.
Some accounts meant to have no usable password store an asterisk in that field.
Under the affected setup, the matching values can let an attacker in without knowing the password.
Exposure requires several conditions
Check the actual build and settings; the OpenSSH name alone does not determine exposure.
Linux with musl
The affected password-check behavior depends on the musl C library.
No PAM password check
sshd must check passwords without PAM, with PasswordAuthentication enabled.
Specific local accounts
An asterisk password field and at least one local $5$ or $6$ password hash are also required.
What the reports establish
Exploit code appeared about four hours after the fix, and GreyNoise later recorded a successful break-in on one sensor.
- A successful intrusion was observed on a GreyNoise sensor.
- Medcrypt reproduced the issue, including on a stock Yocto image.
- The total number of vulnerable or compromised systems.
- All affected embedded products, vendors or deployed devices.
Reduce the risk
Administrators should confirm every affected condition and make sure the fixed daemon is running.
- Install the fixed OpenSSH package and restart sshd.
- If you cannot update promptly, disable password authentication when another safe management method is available.
- Review authentication logs for unexpected password logins to accounts that should not accept passwords.
- Check cloud images and embedded builds, including whether later account or hash changes alter their exposure.
Why the Password Check Fails
The concern is that an attacker who can reach an exposed SSH service may bypass a password check for an account that is meant to have no usable password. Alpine says the attack requires one connection and no retries once the required conditions are present. If the affected account can run commands or elevate privileges, access could provide a route deeper into a system; the extent of any resulting compromise depends on that account’s permissions and the host’s configuration.
This is not a flaw in every OpenSSH installation. Ubuntu says its OpenSSH builds use glibc and PAM and are not affected, while Red Hat says its products are not affected. Systems using glibc, PAM-based password checks, disabled SSH password authentication, or a different SSH server such as Dropbear fall outside the affected conditions described in the advisories. The distinction matters to operators: the software’s name alone does not determine exposure; the library and authentication setup do.
The rapid release of exploit code also shortens the time administrators have to respond after disclosure. Affected services can be reachable from the internet or internal networks, and the reported attack does not require repeated password guesses. Updating and restarting the running daemon, rather than only installing a package, is the immediate defensive step.
Popular right now
Shark Rotator Lift-Away Upright Vacuum with DuoClean PowerFins, Wine Purple, LA702
Dyson V15 Detect Cordless Vacuum
Breville Barista Touch Impress Espresso Machine, Noir (BES881NRE)
As an affiliate, we earn on qualifying purchases.
Patch, Exploit and Scope
Alpine’s advisory explains that sshd’s password check uses musl’s behavior in a way that makes an error indicator indistinguishable from a stored account value. OpenSSH said the root cause is outside sshd, though it can be exploited through sshd and avoided there. Musl maintainer Rich Felker disputed that the library itself is at fault, describing the issue as an erroneous use by the caller; he said musl may change the mechanism in an upcoming release cycle. The fix is therefore available in OpenSSH even as responsibility for the underlying interaction is contested.
Alpine is the best-known affected distribution case in the supplied advisories. The issue also has particular relevance to embedded and customized Linux images, where musl is used and packages or authentication settings may differ from mainstream desktop and server distributions. Medcrypt reported on the oss-security mailing list on November 9 that it had independently reproduced the issue, including on a stock Yocto image. Debian rates the issue unimportant for its packages and lists the fixed upstream version in its unstable branch.
Alpine says fixed packages are available across its branches, including older releases, and warns that installing the update alone does not replace the already-running daemon. Some official Alpine tiny-cloud images also require attention: Alpine says images from versions 3.18.11 through 3.24.3 include an alpine account with an asterisk password field and passwordless doas. They are safe on first boot, the advisory says, but may become exploitable once a $6$ password hash exists on the machine. OpenSSH’s default root-login restriction does not prevent an affected user from gaining root through another privilege-escalation path.
“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”
— Alpine Linux security advisory
Exposure Beyond Alpine Builds
The exact number of vulnerable or compromised systems is not established in the supplied material. GreyNoise’s observation confirms a successful attack against one of its sensors, but does not quantify broader exploitation. The conditions also mean that users of musl-based distributions cannot determine exposure from the distribution name alone: their sshd build, PAM use, password-authentication setting, account fields and local password hashes all matter.
Exposure in embedded products remains less settled. Medcrypt reported reproducing the flaw on a stock Yocto image, but the supplied information does not identify all affected product versions, vendors or deployed devices. The dispute over whether the underlying defect belongs to OpenSSH’s use of the library or to musl’s behavior also remains unresolved in the statements provided.
Update and Restart sshd
Administrators whose systems meet the affected conditions should install the fixed OpenSSH package and restart sshd so the patched daemon is running. Alpine’s instructions include running apk upgrade -U -a; administrators should use the package and restart procedure appropriate to their distribution. If an update cannot be applied promptly, Alpine’s guidance is to set PasswordAuthentication no, provided administrators have another safe way to access and manage the system.
Operators should review authentication logs for password logins to accounts that should not have passwords, then investigate any unexpected access under their incident-response procedures. They should also check cloud images and embedded builds against all of the advisory’s conditions, rather than assuming that a default image remains safe after accounts or password hashes have been added. Further distribution advisories and updates to musl’s behavior may clarify the scope and long-term remediation.
Key Questions
What is the OpenSSH SSHole bug?
CVE-2026-123158 is a password-authentication bypass involving sshd and musl’s crypt() function. In a narrowly defined configuration, an overly long password can cause an error value to match the stored asterisk field of an account that should not accept password logins.
Which systems are affected?
Only systems meeting the advisory’s conditions are affected: Linux with musl, sshd checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and at least one local $5$ or $6$ password hash. Alpine’s standard openssh-server package is a key example. Check the exact build and configuration.
Are Ubuntu, Debian and Red Hat systems vulnerable?
Ubuntu says its OpenSSH builds use glibc and PAM and are not affected; Red Hat says its products are not affected. Debian rates the issue unimportant for its packages. These statements concern those distributions’ builds and do not automatically determine the status of a separately customized system.
How should administrators respond?
Install the fixed OpenSSH version or distribution package and restart sshd. If patching is delayed, disable SSH password authentication where operationally safe, then inspect logs for unexpected password access to accounts that should not accept passwords.
Has the flaw been exploited?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the November 5 patch release. CISA added the flaw to its exploited-vulnerabilities list on November 9. The supplied reporting does not establish the total number of incidents or compromised systems.
Source: ThorstenMeyerAI.com
