🔍 Read the full analysis: How To Understand The OpenSSH SSHole Bug Without The Jargon on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
The OpenSSH flaw CVE-2026-123158 can let an attacker log in without a valid password, but only on systems meeting several specific conditions, including use of musl and password authentication without PAM. OpenSSH released a fix on November 5, 2026; administrators should update and restart sshd or disable password authentication while they wait.
OpenSSH released a fix on November 5 for a flaw that can let attackers log in without a valid password to certain Linux accounts. Tracked as CVE-2026-123158 and nicknamed “SSHole” by its finder, the bug affects a narrow set of systems using the musl C library when OpenSSH checks passwords without PAM; administrators should update and restart the SSH service.
The issue occurs when OpenSSH’s server, sshd, checks passwords without PAM and uses the C library’s crypt() function to compare a submitted password with an account’s stored password field. Alpine Linux’s advisory says musl returns an asterisk (*) when the password supplied to crypt() is longer than 256 bytes. Some accounts that are not meant to accept password logins have an asterisk in that field, so the error value can match the stored value and be treated as a successful password check.
According to the advisory, exploitation requires a password between 257 and 1,024 bytes and a particular account setup. The advisory lists five conditions: Linux with musl; sshd checking passwords without PAM; password authentication enabled; an account with a * password field; and at least one local account with a $5$ or $6$ password hash. Alpine’s standard openssh-server package is a prominent example of a configuration that may meet the software conditions, but exposure depends on the machine’s accounts and settings.
OpenSSH fixed the issue in version 10.6p2. GreyNoise and BleepingComputer reported that public exploit code appeared about four hours after the fix was released, while GreyNoise said it recorded a successful break-in on one of its sensors about 40 hours after release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. Those reports show exploitation activity, but do not establish how many systems have been compromised.
The SSHole bug in plain English
CVE-2026-123158 can bypass password checks on a narrow set of Linux systems. Administrators should patch OpenSSH and restart the SSH service.
How the bypass works
A failed password check can look successful when several specific conditions line up.
The submitted password is between 257 and 1,024 bytes.
Its crypt() function returns “*” for a password longer than 256 bytes.
Some accounts store “*” in the password field, so sshd may treat the check as successful.
Who may be exposed?
The described flaw requires all the relevant system and account conditions to be present.
Linux with musl
The affected password-checking path uses musl’s crypt() function.
Password checks without PAM
Password authentication must be enabled, and sshd must check passwords without PAM.
Specific local account setup
An account must have a “*” password field, and a local account must have a $5$ or $6$ password hash.
What the reports establish
Public exploit code and reported exploitation make timely checks important, but the number of compromised systems is unknown.
- Exploit code appeared about four hours after the fix.
- GreyNoise recorded a successful break-in on one sensor about 40 hours after release.
- CISA listed the vulnerability as exploited on November 9.
- How many systems have been compromised.
- Whether a particular organization was breached.
- How widely qualifying embedded Linux configurations are deployed.
What administrators should do
Check the actual library, package, authentication settings, and account records on each system.
- Install the fixed OpenSSH package, version 10.6p2, following distribution instructions.
- Restart sshd so the running service uses the patched code.
- If an update is not immediately possible, disable password authentication if that fits access requirements.
- Review authentication logs for password logins to accounts without passwords, and check their privileges.
- Check vendor or distribution guidance for embedded devices, including musl based images.
Why the Configuration Matters
The flaw matters because it can turn an account intended for key-only access or no direct password access into a possible route into a machine. If an attacker can reach the SSH service and all the required conditions are present, the issue is a login bypass, not merely a weakness that makes password guessing easier. Access to an account may also create a path to greater control if that account has administrative privileges or can use tools such as doas.
The affected systems are a limited subset of Linux installations, not every OpenSSH server. The source material says Debian, Ubuntu and Red Hat report that their OpenSSH builds are not affected; Ubuntu cites its use of glibc and PAM. Still, Alpine and embedded Linux deployments built with musl may be less visible to central IT teams, making it important for operators to check the actual library, package and authentication settings rather than assume their systems are covered by a distribution-level statement.
There is also a practical timing concern: exploit code reportedly became public hours after the patch, and CISA listed the flaw as exploited. That makes checking exposed systems and completing the service restart part of remediation more urgent. Installing a package without restarting sshd may leave the old, vulnerable daemon running.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Raspberry
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
Sony WH-1000XM5 Premium Noise Cancelling Wireless Headphones – Midnight Blue
As an affiliate, we earn on qualifying purchases.
How the Password Check Failed
In the affected flow, sshd asks crypt() to process the supplied password and then compares the result with the account’s stored field. Alpine’s explanation is that musl uses “*” as an error indicator for an overlong password. For accounts whose stored field is also “*”, the failed password-processing step can look like a match. The vulnerability depends on the interaction between sshd’s password-checking path, musl’s response and the account data; it is not described as affecting all uses of OpenSSH or musl.
The bug has prompted disagreement over where responsibility lies. OpenSSH said the root cause is outside sshd, while also saying the issue is exploitable through sshd and can be avoided there. Musl maintainer Rich Felker said he viewed the behavior as an erroneous use by the caller, rather than a musl bug, and indicated the mechanism might change in a future release cycle. The fix for administrators is available in OpenSSH 10.6p2.
Systems using glibc, PAM, or no password authentication are outside the affected conditions described in the source material. Non-Linux systems, Dropbear installations, and containers that do not run sshd inside are also listed as unaffected. Alpine has warned that some of its tiny-cloud images can become vulnerable after a qualifying password hash is added, even if they were safe on first boot.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long.””
— Alpine Linux security advisory
Exposure Depends on Local Settings
The number of affected or compromised systems is not established in the source material. Reports of a sensor observing a successful break-in and CISA’s listing indicate exploitation, but do not provide a count of victims or show that any particular organization was breached.
Whether a specific host is vulnerable depends on all the listed conditions, including its library, PAM use, password-authentication setting and account records. Alpine is the clearest named case, while exposure across embedded systems is less settled: Medcrypt reported reproducing the issue on a stock Yocto image, but the source does not establish how widely that configuration is deployed. The exact scope of affected OpenWrt, Buildroot and Yocto products also remains unclear.
The source material also describes differing views about whether the underlying defect belongs to musl or its caller. That debate does not change the immediate mitigation, but the status of a possible musl-side change is not confirmed here.
Patch, Restart and Review Logs
Administrators should install a fixed OpenSSH package and restart sshd so the running service uses the patched code. Alpine says fixed packages are available across its branches, including older releases, and lists version-specific package details in its advisory. Operators should follow their distribution’s package instructions rather than assume that installing an update alone has completed the fix.
If updating is not possible immediately, the recommended temporary measure is to set PasswordAuthentication no, provided that change fits the organization’s access requirements. Administrators should also review authentication logs for password logins to accounts that have no password, and check whether any such account can obtain elevated privileges. The source material does not specify a single log pattern that will identify every attempted or successful attack.
Teams responsible for embedded devices should identify whether their images use musl and the affected OpenSSH authentication path, then check vendor or distribution advisories for fixed packages. Further clarification may come from distribution maintainers and any changes musl makes in a later release cycle.
Key Questions
Does SSHole affect every OpenSSH server?
No. The described flaw requires a specific combination: Linux using musl, sshd checking passwords without PAM, password authentication enabled, an account with a * password field, and a local account with a $5$ or $6$ hash. The source says Debian, Ubuntu and Red Hat report their OpenSSH builds are not affected.
What should an administrator do first?
Install the fixed OpenSSH package and restart sshd. If an update cannot be applied promptly, disable password authentication where operationally possible, then review logs and account permissions.
Can an account with no password really be exposed?
Under the required conditions, yes. Alpine says musl can return * as an error indicator for an overlong password, while some accounts store * as their password field. That matching value can cause sshd’s check to accept the login.
Is there evidence that attackers used the flaw?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the fix was released, and CISA added the flaw to its exploited-vulnerabilities list on November 9. The available material does not say how many systems were compromised.
Does installing the patch finish the fix?
Not by itself. Alpine warns that the running sshd process must be restarted after the package update so it loads the patched version.
Source: ThorstenMeyerAI.com
