🔍 Read the full analysis: What We Know About The OpenSSH SSHole Bug And Attacks On Linux Servers on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
CVE-2026-123158, nicknamed “SSHole,” can allow passwordless access to certain accounts on Linux servers running OpenSSH with musl, without PAM, and password authentication enabled. OpenSSH released version 10.6p2 on November 5, 2026; security researchers reported public exploit code and a successful attack on a monitoring sensor soon afterward. Administrators should update and restart sshd, or disable password authentication if they cannot update.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a high-severity flaw that can let attackers access certain accounts on specially configured Linux servers using an overlong password. The issue, nicknamed “SSHole” by its finder, is limited to systems using the musl C library without PAM, with password logins enabled; reports of public exploit code and a successful attack on a monitoring sensor make timely patching important for affected administrators.
The flaw depends on how OpenSSH’s sshd checks passwords on affected systems. Alpine Linux’s advisory says musl’s crypt() function returns an asterisk (*) as an error indicator when a password exceeds 256 bytes. That same character can appear in the stored password field for an account that has no usable password. In the affected configuration, the error value can be mistaken for a matching password field, allowing authentication.
According to the supplied account of Alpine’s advisory, an attacker can trigger the problem with a password between 257 and 1,024 bytes. The machine also needs at least one local account with a $5$ or $6$ password hash, as sshd uses that account’s salt for the check. The specific accounts at risk are those whose stored field is *; this does not mean all accounts or all Linux servers are vulnerable.
Exploit activity followed the patch. GreyNoise and BleepingComputer reportedly said exploit code became public about four hours after the release. GreyNoise said its sensor recorded a first successful break-in about 40 hours after the release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. These reports establish observed activity, but the supplied material does not identify victims or describe the scale of attacks.
OpenSSH 10.6p2 contains the fix. Alpine published fixed packages for its branches, including versions back to 3.16, according to its advisory. Administrators should install the update and restart sshd so the running service uses the patched code. Where an update is not immediately possible, the supplied guidance is to set PasswordAuthentication no and review authentication logs for password logins to accounts with no password.
The OpenSSH SSHole Bug and Linux Server Risk
CVE-2026-123158 can enable passwordless access on a narrowly configured set of Linux servers. Public exploit code and a reported successful break-in make prompt checks and patching important.
When the login check can fail
The risk requires every part of this configuration to line up.
The server runs OpenSSH with musl, and PAM is absent from the authentication path.
An attacker can submit an overlong password to sshd.
musl returns “*” for the overlong password; an account with a “*” stored field can be mistaken as authenticated. A qualifying local $5$ or $6$ hash must also be present.
Check exposure by configuration
An operating system name alone does not establish whether a server is vulnerable.
| Environment | What the supplied reports say |
|---|---|
| Alpine Linux | Best-known affected case; check customized systems and package status. |
| OpenWrt, Buildroot, Yocto | Named environments to check; a stock Yocto image was reportedly reproduced. |
| Ubuntu, Red Hat | Advisories say their standard products are not affected. |
| Debian | Tracker labels the issue “unimportant” for its packages; upstream fix listed in unstable. |
What exploitation reports establish
Exploit code appeared after the patch, and a monitoring sensor recorded a successful break-in.
Patch, restart and review
Administrators can reduce risk with a short set of checks and actions.
- Check the C library, PAM use, PasswordAuthentication setting, account fields and qualifying local hashes.
- Install OpenSSH 10.6p2 or a fixed distribution package, then restart sshd.
- If an update must wait, set PasswordAuthentication no if compatible with access needs.
- Review authentication logs for successful password logins to accounts with a “*” field; check their privilege paths.
Which Servers Face Login Risk
The issue matters most to operators of Alpine Linux and other musl-based systems that expose SSH to a network and meet every required configuration condition. A successful login can give an attacker access as the affected account; the consequences depend on that account’s permissions and what else the attacker can reach from the server.
Alpine warns that protecting root through OpenSSH’s default PermitRootLogin prohibit-password setting may not be enough if another account can gain root privileges, for example through doas. Alpine’s advisory identifies official tiny-cloud images from versions 3.18.11 through 3.24.3 as a case where an alpine account with a * password field and passwordless doas can become exploitable once a qualifying $6$ hash is present. The advisory says those images are safe on first boot, but administrators should check changes made afterward.
The reported exploitation means affected administrators should treat this as an active security issue, not only a theoretical bug. At the same time, the exposure is conditional: major distribution advisories cited in the source say their standard builds are not affected, and systems that do not meet the configuration requirements are outside the described vulnerable setup.
Popular right now
Shark ZU102 Rotator Pet Upright Vacuum with PowerFins HairPro & Odor Neutralizer Technology, Charcoal
Dyson V15 Detect Cordless Vacuum
Samsung 43-Inch M70H Series 4K Mini LED Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
Why the Password Check Failed
The affected sequence combines an account’s stored password field with an error response from a separate component. Accounts that should not accept password logins can have * in the password field. On the relevant systems, an overlong password makes musl return the same character as an error indicator. Without PAM in the authentication path, sshd can treat those matching values as a successful check.
The source says OpenSSH regards the root cause as outside sshd, while noting the issue is exploitable through sshd and can be avoided there. Musl maintainer Rich Felker disputed that framing, saying he considers the problem an erroneous use of musl by its caller and that musl may change the mechanism in an upcoming release cycle. The source does not describe a final agreement over which project owns the underlying defect.
Distribution statements narrow the likely scope. Ubuntu says its OpenSSH is linked against glibc and uses PAM, so it is not vulnerable to this issue; Red Hat says its products are not affected. Debian’s security tracker labels the issue “unimportant” for its packages and lists upstream version 1:10.6p2-1 as fixed in its unstable branch. Alpine is the best-known affected case in the source, which also names OpenWrt, Buildroot and Yocto as environments to check. Medcrypt reported reproducing the issue on a stock Yocto image, but that is a company’s report, not evidence that every Yocto deployment is vulnerable.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.””
— Alpine Linux advisory
Scope and Victim Details Remain Unknown
The supplied reporting does not say how many servers have been attacked, whether any named organization was compromised, or what data or systems attackers accessed. GreyNoise’s report concerns a successful break-in on one of its sensors; it does not establish the total number of incidents.
Exposure also cannot be inferred from the operating system name alone. Administrators need to check the C library, whether sshd uses PAM, the PasswordAuthentication setting, affected account fields and the presence of a qualifying local password hash. Embedded and customized systems may differ from distribution defaults. The material identifies a reproduced stock Yocto case, but does not provide a complete inventory of affected devices or configurations.
The source also leaves open how the OpenSSH and musl projects will address responsibility for the underlying behavior. Felker said musl might change its mechanism in a future release cycle; no release date or final design is provided.
Patch, Restart and Review Logs
Administrators should first determine whether their systems meet the vulnerable conditions, then install OpenSSH 10.6p2 or a distribution package containing the fix. On Alpine, the advisory’s command is apk upgrade -U -a; administrators must also restart sshd, since upgrading the package alone does not replace the running daemon.
If patching must wait, disable password authentication by setting PasswordAuthentication no, provided that change fits the server’s access requirements. Review SSH authentication logs for successful password logins to accounts whose stored password field is *, and check whether any such account can gain elevated privileges. The source recommends these checks but does not provide a specific log query or say that every historical login can be conclusively identified.
Further developments will depend on distribution updates, operator investigations and any changes to musl’s error handling. Organizations using embedded Linux should check vendor guidance for their exact build rather than assume that a named distribution or project is either universally affected or universally safe.
Key Questions
What is the OpenSSH SSHole bug?
CVE-2026-123158 is an authentication flaw in a specific OpenSSH and musl configuration. An overlong password can cause musl’s crypt() function to return *, which may match the stored field for an account that has no usable password and result in access.
Which Linux servers are affected?
A server is at risk only if all the described conditions apply: it runs Linux with musl, sshd checks passwords without PAM, password authentication is enabled, an account has a * password field, and at least one local account has a $5$ or $6$ hash. Alpine’s standard OpenSSH package is a prominent example in the source.
Are Ubuntu, Debian and Red Hat systems vulnerable?
The source says Ubuntu and Red Hat reported their products are not affected. Debian’s tracker calls the issue “unimportant” for its packages and lists a fixed upstream version in its unstable branch. Administrators should still check the advisory and package status for their specific system.
How should administrators respond?
Install OpenSSH 10.6p2 or the applicable fixed distribution package, then restart sshd. If an update cannot be applied promptly, disable password authentication and inspect logs for suspicious password logins to accounts with a * field.
Does reported exploitation mean my server was attacked?
No. GreyNoise reportedly observed a successful break-in on one sensor, and CISA listed the flaw among exploited vulnerabilities. Those reports do not show that every exposed system was targeted or compromised; each operator must assess its own configuration and logs.
Source: ThorstenMeyerAI.com
