🔍 Read the full analysis: OpenSSH SSHole Bug: A Linux Server Password Flaw Under Attack on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A vulnerability tracked as CVE-2026-123158 can allow passwordless SSH access on certain Linux systems that use musl, run OpenSSH without PAM and permit password logins. OpenSSH released a fix on November 5, 2026; exploit code appeared about four hours later, and GreyNoise reported a successful break-in on one sensor about 40 hours after release. Administrators should update and restart sshd, or disable password authentication if they cannot update.
A flaw in OpenSSH can let an attacker log in without a valid password to certain Linux accounts, and security researchers reported exploitation soon after a fix was released. Tracked as CVE-2026-123158 and rated High at 8.1, the bug affects a limited set of systems using the musl C library, running sshd without PAM and allowing password logins.
OpenSSH released the corrective version 10.6p2 on November 5. GreyNoise and BleepingComputer reported that exploit code became public about four hours later. GreyNoise said it recorded the first successful break-in on one of its sensors about 40 hours after the release. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its list of exploited vulnerabilities on November 9.
The issue arises when OpenSSH checks passwords without PAM on systems using musl. Alpine Linux’s advisory says musl’s crypt() function returns an asterisk as an error indicator for an overlong password. Accounts configured with an asterisk as their stored password field can then produce a matching result. According to the advisory, an attacker can trigger the condition with a password between 257 and 1,024 bytes.
The bypass requires several conditions to coincide: Linux with musl, password checking without PAM, password authentication enabled, an account whose password field is an asterisk, and at least one local account with a $5$ or $6$ password hash. Alpine’s standard openssh-server package is a prominent affected configuration. Administrators are advised to install a fixed package and restart sshd; if an update is not available, they can set PasswordAuthentication no and review logs for suspicious password logins to accounts without passwords.
OpenSSH SSHole Bug A password flaw under attack
A configuration-dependent flaw can allow passwordless SSH access on some Linux systems using musl. Administrators should check exposure, apply the fix and review logs.
Exposure depends on configuration
The conditions must coincide for the password bypass to work.
Linux with musl
Check the system’s C library, especially on Alpine and embedded builds.
No PAM, passwords allowed
The flaw requires sshd to check passwords without PAM while password authentication is enabled.
Asterisk password field
An affected account must have an asterisk in its stored password field, and a local account must have a $5$ or $6$ hash.
How the bypass happens
On affected systems, a long password can make an error result look like a stored account value.
An attacker who can reach SSH can trigger the condition with a password between 257 and 1,024 bytes.
Its crypt() function uses an asterisk as an error indicator for an overlong password.
For an account with an asterisk password field, the error result can match and allow login.
Reported activity and open questions
Exploit code and a sensor report raise urgency, but the reports do not establish the scale of compromise.
What administrators should do
Verify the effective configuration and make sure the running SSH daemon has the fix.
- Install OpenSSH 10.6p2 or a distribution package containing the fix, then restart sshd.
- If you cannot update promptly, set PasswordAuthentication no and confirm the effective setting.
- Review authentication logs for successful password logins to accounts intended to have no password.
- Check whether affected accounts can use privileged tools such as doas.
- Ask vendors or build maintainers to verify customized and embedded Linux systems.
Exposure Depends on Server Configuration
The flaw is not a general password bypass affecting every OpenSSH server. Its impact depends on a specific combination of software and settings, but an exposed SSH service can be reachable remotely. That makes identifying the underlying C library, PAM use and password-authentication setting important for administrators, particularly those managing Alpine or embedded Linux systems.
Alpine says an attacker who can reach the SSH port can trigger the issue with one connection, without repeated password guesses. The risk can extend beyond the account reached directly: Alpine warns that a user who can log in may be able to gain higher privileges through tools such as doas. In some Alpine cloud images, an account configured with an asterisk password and passwordless doas can become exposed once a qualifying password hash is present.
The quick appearance of public exploit code and GreyNoise’s sensor report make the patch more urgent for affected systems. Those observations establish that exploitation activity was reported; they do not show how many servers were compromised or how widespread attacks are.
Products Worth Considering
Jackery Solar Generator 1000 v2 with 100W Solar Panel
DJI Mic 3 (2 TX + 1 RX + Charging Case) Wireless Microphone
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
How the Asterisk Match Occurs
On affected configurations, sshd checks a supplied password using the system’s C library when it is not using PAM. Alpine’s explanation is that musl returns an asterisk when crypt() receives a password longer than 256 bytes. Some accounts that should not accept password logins also have an asterisk in their password field. The error result can therefore appear to match the stored field, allowing authentication to succeed.
The researcher calls the issue “sshole.” The source report says the flaw is limited to Linux systems using musl and that Debian, Ubuntu and Red Hat report their OpenSSH builds are not affected. Ubuntu cites its use of glibc and PAM; Red Hat also says its products are unaffected. The report identifies OpenWrt, Buildroot and Yocto as systems to examine, while a Medcrypt researcher said on the oss-security mailing list that the issue was independently reproduced on a stock Yocto image.
Responsibility for the underlying behavior is disputed. OpenSSH said the root cause is outside sshd, though the issue is exploitable through sshd and can be avoided there. Musl maintainer Rich Felker argued that the problem is an erroneous use by the caller, while saying musl may change the mechanism in an upcoming release cycle.
““An attacker who can reach your SSH port can log in without knowing any password.””
— Alpine Linux security advisory
Scope and Intrusions Still Unclear
The available reports do not establish how many servers have been exposed or compromised. GreyNoise’s account concerns a successful break-in on one of its sensors; it is not a count of victim systems. The source material does not provide details about the affected account, an attacker’s identity or the consequences of that intrusion.
Administrators of less common or customized Linux builds may need to check their own packages and settings. The reported reproduction on a stock Yocto image suggests embedded deployments warrant review, but it does not establish that every Yocto system is affected. The conditions must be checked on each system, including whether it uses musl, whether PAM is in use, and whether password authentication is enabled.
The technical dispute over whether the root cause belongs to musl or its caller also remains open. The source report says musl may alter its behavior in a future release cycle, but gives no release date. CISA’s listing confirms the vulnerability was added to its exploited-vulnerabilities list; it does not by itself quantify current attack activity.
Patch, Restart and Review Logs
Administrators should install OpenSSH 10.6p2 or a distribution package containing the fix, then restart sshd. Alpine says installing the package alone does not replace the already running daemon. Its advisory lists fixed packages across supported and older branches, so Alpine users should consult the package version for their specific release rather than assume an upgrade has taken effect.
Where a prompt update is not possible, administrators can set PasswordAuthentication no and confirm that the effective sshd configuration disables password logins. They should also inspect authentication logs for successful password logins to accounts that are intended to have no password. Review whether any such account can reach privileged tools or otherwise gain elevated access.
Organizations running embedded builds should verify their libc and OpenSSH configuration with their vendor or build maintainers. Further updates may clarify the scale of exploitation, affected deployments and whether musl changes its error behavior. Until then, the reported conditions provide the basis for deciding which systems need immediate remediation.
Key Questions
Which systems are affected by the OpenSSH SSHole flaw?
The source report says all listed conditions must apply: the system is Linux with musl, sshd checks passwords without PAM, password authentication is enabled, an account has an asterisk password field, and at least one local account has a $5$ or $6$ password hash. Alpine’s standard openssh-server package is a prominent example.
Are Debian, Ubuntu and Red Hat systems affected?
The source material says Debian, Ubuntu and Red Hat report their OpenSSH packages are not affected. Ubuntu cites its use of glibc and PAM; Red Hat says its products are unaffected. Administrators of customized systems should still verify their actual configuration.
What should administrators do now?
Install OpenSSH 10.6p2 or a distribution package with the fix, then restart sshd. If updating is not possible, disable password authentication and review logs for successful password logins to accounts that should not accept them.
Does the flaw affect every account or every SSH server?
No. The reported bypass requires a specific combination of Linux, musl, OpenSSH password checking without PAM, enabled password authentication and account password fields. The source says non-Linux systems, glibc-based systems, PAM-based checks and systems with password authentication disabled are not affected by this issue.
How widespread are the attacks?
The source material does not establish the number of compromised servers. GreyNoise reported one successful break-in on a sensor about 40 hours after the fix was released, while public exploit code was reported about four hours after release.
Source: ThorstenMeyerAI.com
