🔍 Read the full analysis: Linux Server Security: The OpenSSH SSHole Bug And Overlong Passwords on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
OpenSSH flaw CVE-2026-123158 can allow passwordless login on some Linux servers using musl, without PAM, when password authentication is enabled and several account conditions are met. OpenSSH released version 10.6p2 on November 5, 2026; admins should update and restart sshd or disable password authentication while patching.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a password-bypass flaw that can affect certain Linux servers using the musl C library without PAM. The issue, nicknamed “SSHole” by its finder, requires a specific combination of server and account settings; security monitors reported public exploit code and a successful login attempt against a sensor after the patch was released.
The flaw can arise when sshd checks passwords without PAM and calls musl’s crypt() function. Alpine Linux’s advisory says that when the entered password exceeds 256 bytes, musl returns an asterisk as an error indicator. On affected setups, that can match the asterisk stored for an account with no password, causing sshd to accept the login. The source says an attacker can send a password between 257 and 1,024 bytes.
That behavior alone does not make every Linux SSH server vulnerable. The listed conditions include Linux with musl, password checking without PAM, PasswordAuthentication enabled, an account with an asterisk in its password field, and at least one local account with a $5$ or $6$ password hash. Alpine’s standard openssh-server package is a prominent example of the relevant configuration. The source identifies OpenWrt, Buildroot and Yocto systems as potential areas to check, while a Medcrypt report says the issue was reproduced on a stock Yocto image.
GreyNoise and BleepingComputer reported that exploit code became public about four hours after the release. GreyNoise said it recorded the first successful break-in on one of its sensors about 40 hours after release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. These reports establish observed activity, but do not show how many servers were exposed or compromised.
OpenSSH SSHole Bug and Overlong Passwords
A specific combination of Linux, musl and SSH settings can allow passwordless login. Admins should patch affected servers and review access.
When Exposure Exists
The flaw requires a specific server and account configuration; OpenSSH alone does not make a system vulnerable.
Linux with musl
The described issue involves sshd using musl’s crypt() without PAM.
Password access enabled
PasswordAuthentication must be enabled, and password checks must run without PAM.
Specific password fields
An asterisk password field and at least one local $5$ or $6$ hash are among the listed conditions.
How the Check Can Fail
On affected setups, an error marker can be mistaken for a valid match.
The described attack sends a password between 257 and 1,024 bytes.
For passwords over 256 bytes, Alpine says crypt() returns an asterisk as an error indicator.
An account with an asterisk in its password field may be accepted on qualifying systems.
Reported Activity and Scope
Monitoring reports describe exploitation, but the supplied information does not establish the number of exposed servers or compromised organizations.
Reduce Risk
Check the actual system build and settings, especially on embedded Linux images.
- Install the fixed OpenSSH package and restart sshd.
- If patching must wait, disable PasswordAuthentication when another safe management path is available.
- Confirm whether the server uses musl, whether PAM handles password checks, and whether the account conditions apply.
- Review SSH logs for password logins to accounts that should not accept passwords; investigate suspicious activity through incident response.
Exposure Depends on Server Configuration
The flaw matters because it can bypass password checks for some accounts that administrators may have deliberately left unable to log in with a password. If an affected server is reachable over SSH, the risk may extend beyond the targeted account: Alpine warns that a user who can log in may be able to gain greater privileges through tools such as doas.
Alpine specifically flags official tiny-cloud images from versions 3.18.11 through 3.24.3. The advisory says those images include an alpine user with an asterisk password field and passwordless doas, and become exploitable once a qualifying $6$ hash exists on the machine. The source says the images are safe on first boot, but that qualification does not remove the need to review later changes and installed packages.
The reports do not support treating all Linux servers as affected. Ubuntu says its OpenSSH build uses glibc and PAM and is not vulnerable; Red Hat says its products are not affected. Those distribution statements underline why administrators should verify the actual operating system, package and configuration rather than infer exposure from the presence of OpenSSH alone.
Products Worth Considering
Bose QuietComfort Ultra Wireless Over-Ear Headphones with Spatial Audio and Noise Cancellation, Black
LG UltraGear 32-inch Curved QHD Gaming Monitor (2560×1440, 180Hz, 1ms, 1000R, HDR10)
Bose QuietComfort Wireless Over-Ear Noise-Cancelling Headphones, Sandstone
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
On a typical Linux system, a locked or passwordless account may have a marker such as an asterisk in the password field. The intended result is that no supplied password matches it. In the scenario described by Alpine, however, the error return from musl’s crypt() can be the same asterisk. The comparison then treats a failure to calculate a password hash as a match.
OpenSSH and musl have disagreed over where the underlying defect belongs. OpenSSH said the root cause is outside sshd but can be avoided there. Musl maintainer Rich Felker argued on the musl mailing list that the issue is an erroneous use by the caller, not a musl bug, while saying the mechanism may change in an upcoming release cycle. OpenSSH’s 10.6p2 release supplies a fix at the server level.
The source says non-Linux systems, Linux using glibc, systems using PAM for password checks, servers with PasswordAuthentication no, Dropbear, and containers that do not run sshd are not affected. It also says accounts marked with an exclamation point rather than an asterisk cannot log in through this issue. These distinctions are based on the cited advisories and statements, not a guarantee that every custom build has the same configuration.
“An attacker who can reach your SSH port can log in without knowing any password.”
— Alpine Linux security advisory
Scope and Root Cause Remain Disputed
The total number of vulnerable servers and any confirmed victim organizations were not stated in the supplied material. GreyNoise’s report describes a successful break-in on one of its sensors, not a count of real-world intrusions. Public exploit code and CISA’s listing show that the issue is being treated as exploited, but they do not establish the scale of compromise.
Exposure across embedded Linux products is also not fully mapped. Medcrypt reported reproducing the flaw on a stock Yocto image, while the source does not identify all affected vendors, builds or deployed devices. Administrators should check their own software and configuration rather than assume a distribution-wide status applies to a custom image.
The technical responsibility remains contested: OpenSSH places the root cause outside sshd, while musl’s maintainer attributes the problem to caller behavior and said the mechanism may change. The supplied information does not detail every implementation change in 10.6p2 or provide independent testing results for all affected configurations.
Patch, Restart and Review Logs
Administrators should install the fixed OpenSSH package and restart sshd. Alpine says fixed packages were published for branches back to 3.16, including older branches that no longer receive regular updates. It cautions that upgrading the package alone does not replace an already running daemon.
If a patch cannot be applied immediately, the source recommends setting PasswordAuthentication no as a temporary measure, provided administrators have another safe way to access and manage the server. Teams should confirm whether PAM is in use, whether the server is built against musl, and whether the relevant account and password-hash conditions exist.
After patching or restricting password access, administrators should review SSH authentication logs for password logins to accounts that should not accept passwords, including accounts with an asterisk password field. The source does not provide a definitive log signature or a method for determining compromise from logs alone, so suspicious activity should be investigated using the organization’s incident-response process. Further guidance may follow as distribution advisories and musl’s planned changes develop.
Key Questions
Which servers can be affected by the SSHole flaw?
According to the supplied advisories, exposure requires a specific combination: Linux using musl, sshd checking passwords without PAM, password authentication enabled, an account with an asterisk in its password field, and at least one local $5$ or $6$ password hash.
Are Debian, Ubuntu and Red Hat systems affected?
The source says Ubuntu and Red Hat reported their builds are not affected. Debian’s tracker classifies the issue as unimportant for its packages and lists the fixed upstream version in its unstable branch. Local custom builds or configurations should still be checked against the stated conditions.
What should server administrators do now?
Install the fixed OpenSSH package, then restart sshd. If updating is delayed, disable password authentication where operationally safe, and examine SSH logs for password logins to accounts that should not accept them.
Does disabling password authentication prevent the reported attack?
The source lists systems with PasswordAuthentication no as not affected by this flaw. Administrators should verify that the setting is active in the configuration actually used by sshd and still install the available security update.
Does a successful sensor attack mean my server was compromised?
No. GreyNoise reported a successful break-in on one of its sensors, but that does not show that a particular server was targeted or compromised. Organizations should assess their own exposure and logs; the supplied material gives no estimate of total victims.
Source: ThorstenMeyerAI.com
