🔍 Read the full analysis: OpenSSH SSHole: Why Security Teams Are Watching This Password Bug on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
OpenSSH flaw CVE-2026-123158 can let an attacker log in to certain accounts without a valid password, but only under a specific set of Linux, musl, and SSH configuration conditions. OpenSSH released version 10.6p2 on November 5, 2026; exploit code appeared hours later, and CISA added the vulnerability to its exploited-vulnerabilities list on November 9.
OpenSSH released version 10.6p2 on November 5 to fix a password-authentication flaw, CVE-2026-123158, that can allow login without a valid password on a limited set of Linux systems. The issue, called “sshole” by its finder, is drawing attention because public exploit code appeared about four hours after the fix, and CISA added the vulnerability to its exploited-vulnerabilities list on November 9, according to the supplied source material.
The bypass requires a particular combination: Linux running the musl C library, OpenSSH checking passwords without PAM, password authentication enabled, and an account whose stored password field is an asterisk. The machine must also have at least one local account with a $5$ or $6$ password hash, according to Alpine Linux’s advisory. Alpine’s standard OpenSSH server package is a prominent example of an affected configuration.
The failure involves how musl’s crypt() function handles an excessively long password. Alpine says that for a key longer than 256 bytes, the function returns an asterisk as an error indicator. Because an asterisk can also be the stored password field for an account that has no password, the check can treat the error result as a match. The supplied report says a password between 257 and 1,024 bytes can trigger the condition.
GreyNoise and BleepingComputer reported that exploit code became public roughly four hours after the November 5 release. GreyNoise recorded a first successful break-in on one of its sensors about 40 hours after release, while CISA listed the flaw as exploited on November 9. The source does not provide a count of affected systems or confirmed victims beyond that sensor observation.
SSHole: Why Teams Are Watching
CVE-2026-123158 can bypass password checks on systems with a specific combination of Linux, musl, account, and SSH settings. Exploitation was reported soon after the fix.
When the bypass can work
The reported conditions must come together on the same system.
The affected password check depends on musl’s crypt() behavior.
Password authentication must be enabled, and OpenSSH must check passwords without PAM.
The target account has an asterisk in its stored password field, and a local account has a $5$ or $6$ hash.
How an error can look like a match
An overlong password can turn an error result into the same marker used for an account with no password.
- A password between 257 and 1,024 bytes can trigger the reported condition.
- For a key longer than 256 bytes, musl’s crypt() returns an asterisk as an error indicator.
- An asterisk may also be the account’s stored password field.
- The check can treat the error result as a match and allow login without a valid password.
Which systems need attention?
The flaw is configuration-specific; the supplied advisories identify several unaffected setups.
| Deployment | Reported status |
|---|---|
| Alpine standard OpenSSH server package | Prominent affected example |
| OpenWrt, Buildroot, and Yocto | Named as environments to check |
| glibc or PAM; non-Linux; Dropbear | Not affected according to supplied advisories |
| Ubuntu OpenSSH and Red Hat products | Reported not vulnerable |
What administrators should do
Check customized and embedded systems as well as standard servers.
- Install the fixed OpenSSH release for the distribution and restart the SSH daemon.
- If patching is delayed, consider disabling PasswordAuthentication where compatible with access requirements.
- Review authentication logs for password logins to accounts that have no password.
- Check whether any accessible account can gain root privileges through another mechanism.
Why the Login Bypass Matters
The incident matters because an attacker who can reach an exposed SSH service may be able to access an account without knowing its password, if all required conditions are present. SSH is commonly used for remote administration, so a vulnerable host could provide a route into a server or network. The exact access an intruder gains depends on the account’s permissions and the system’s configuration; the flaw does not by itself mean every affected machine grants root access.
Speed of exploitation is another concern for administrators. The source reports public exploit code within hours and a successful attempt on a GreyNoise sensor within about 40 hours. Those observations do not establish how widespread exploitation is, but they make prompt patching and log review prudent for systems that may meet the conditions.
The report also highlights a less common deployment risk in embedded and purpose-built Linux systems. Alpine is the best-known affected case, while the researcher also names OpenWrt, Buildroot, and Yocto. Device makers and operators may use these environments in products that are harder to inventory or patch than standard servers.
Products Worth Considering
Amazon Kindle Scribe (3rd Generation), 64GB, 11-inch Display, Graphite, with Premium Pen
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Logitech MX Keys S Combo Wireless Keyboard and Mouse, Graphite
As an affiliate, we earn on qualifying purchases.
How the musl Error Becomes a Match
OpenSSH’s account points to a defect outside the SSH server itself, while acknowledging that the behavior can be avoided in sshd. The source quotes OpenSSH as saying it considers the root cause to be outside sshd, but that the flaw is exploitable through sshd. Musl maintainer Rich Felker, in a mailing-list post, argued that the issue was not a musl bug but an erroneous use by the caller; he said musl might change the mechanism in an upcoming release cycle.
The bypass is not a general OpenSSH password flaw. The supplied advisories say systems using glibc or PAM, non-Linux systems, systems with password authentication disabled, and systems using Dropbear are not affected. Ubuntu says its OpenSSH build uses glibc and PAM and is not vulnerable; Red Hat says its products are not affected. Debian’s tracker describes the issue as “unimportant” for its packages and lists the fixed upstream version in its unstable branch.
Alpine also warns that some official tiny-cloud images can become vulnerable after setup if a local account with a real password hash is added. Its advisory says the images are safe on first boot but can meet the exploit conditions later. A default OpenSSH restriction on direct root password login does not necessarily prevent escalation if another accessible account can gain root privileges through a tool such as doas.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.””
— Alpine Linux advisory
Exposure and Exploitation Still Unclear
The number of vulnerable machines and the scale of real-world exploitation are not established in the supplied reporting. GreyNoise’s sensor observation confirms a successful attempt on that sensor, not a broad tally of compromised hosts. CISA’s listing indicates the flaw was added to its exploited-vulnerabilities list, but the source does not give details about affected organizations or incidents.
Operators of customized, embedded, or older Linux images may not know whether their OpenSSH build uses musl, bypasses PAM, or has the account and password-hash conditions needed for exploitation. The source also reports a disagreement about whether the root cause lies in sshd or musl. It does not specify when any proposed change to musl will ship.
Patch, Restart, and Check SSH Logs
Administrators should install the fixed OpenSSH release available for their distribution and restart the SSH daemon; installing a package alone may leave the old running process active, Alpine warns. Alpine says fixed packages were published across its branches from edge back to 3.16. Package versions and update commands vary by release, so operators should follow their distribution’s advisory rather than assume the same package is available everywhere.
If an update cannot be applied promptly, the supplied guidance is to set PasswordAuthentication no where that change is compatible with access requirements. Administrators should then review authentication logs for password logins to accounts that have no password. They should also check whether any account can become root through another mechanism, particularly on affected Alpine cloud images.
Security teams should inventory systems using musl and verify their SSH authentication configuration, especially in embedded environments. The next developments to watch are distribution package updates, any change in musl’s handling of overlong inputs, and further reporting on exploitation. The source does not provide a date for a musl change or a broader estimate of affected systems.
Key Questions
What is the OpenSSH SSHole vulnerability?
CVE-2026-123158 is a password-authentication bypass that can affect certain OpenSSH deployments on Linux using musl without PAM. In the required conditions, an overly long password can produce an error value that matches an asterisk stored for an account without a password.
Which systems are reported as affected?
A system must meet several conditions: Linux with musl, OpenSSH password checking without PAM, password authentication enabled, an account with an asterisk password field, and at least one local account with a $5$ or $6$ hash. Alpine’s standard OpenSSH server package is a known example. Administrators should check their distribution’s advisory and actual configuration.
Are Ubuntu, Debian, and Red Hat affected?
According to the supplied source, Ubuntu says its OpenSSH build uses glibc and PAM and is not affected, and Red Hat says its products are not affected. Debian’s tracker rates the issue “unimportant” for its packages and lists an upstream fix in its unstable branch. Check current vendor advisories for package-specific status.
What should administrators do now?
Install the distribution’s fixed OpenSSH package and restart sshd. If patching is delayed, disable password authentication if operationally possible, then inspect logs for password logins to accounts with no password. Also review whether accessible accounts can gain elevated privileges.
Does the report show widespread exploitation?
No. It reports public exploit code about four hours after the fix and a successful break-in on one GreyNoise sensor about 40 hours after release, as well as CISA’s November 9 listing. Those details show exploitation activity but do not establish how many systems were affected or compromised.
Source: ThorstenMeyerAI.com
