🔍 Read the full analysis: OpenSSH SSHole: What The Bug Could Mean For Linux Server Defenses on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
OpenSSH fixed CVE-2026-123158, nicknamed “SSHole,” in version 10.6p2. The password-bypass flaw requires a specific combination of Linux, musl, non-PAM password checking and account settings; the source reports public exploit code and a successful attack observed by GreyNoise. Administrators should update and restart sshd, or disable password authentication if they cannot patch.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a high-severity authentication flaw nicknamed “SSHole.” The bug can let a remote attacker access certain accounts without a valid password, but only on systems that meet a specific combination of Linux, musl library and SSH configuration conditions. Reports cited in the source say exploit code appeared within hours, and GreyNoise later recorded a successful break-in on a sensor.
The vulnerability arises when OpenSSH checks passwords without PAM on Linux systems using the musl C library. According to Alpine Linux’s advisory, musl’s crypt() function returns an asterisk when given an input longer than 256 bytes. Some accounts that have no password use the same asterisk in the system’s password field. Under the affected conditions, the failed password check can therefore appear to match that field. The attacker sends a very long password; the source says inputs from 257 to 1,024 bytes can trigger the issue.
The bug is not present on every musl-based machine. Alpine’s advisory lists several required conditions: sshd must run on Linux with musl, check passwords without PAM, and allow password authentication. The system must also have an account with an asterisk password field and at least one local account with a $5$ or $6$ password hash. Alpine says a single account with a real password hash can meet that last condition. Alpine’s standard openssh-server package is a prominent affected configuration.
OpenSSH 10.6p2 contains the fix. The source reports that public exploit code appeared about four hours after release, citing GreyNoise and BleepingComputer, and that GreyNoise observed its first successful break-in roughly 40 hours after release. CISA added the flaw to its exploited-vulnerabilities list on November 9. These reports indicate active exploitation, but do not establish that any particular server or organization was compromised.
OpenSSH SSHole What server defenses need to know
A password bypass affects a specific combination of Linux, musl and SSH settings. Administrators should check exposure, update OpenSSH and restart sshd.
When the bypass can work
A server is exposed only when the required software, authentication and account conditions combine.
The affected password check uses musl’s crypt() function.
sshd must check passwords without PAM, with password authentication enabled.
An asterisk password field and a local account with a $5$ or $6$ hash must be present.
Check the actual system
A distribution name alone does not determine whether a server is vulnerable.
- Alpine’s standard openssh-server configuration
- Some Alpine cloud images under the stated account conditions
- Other musl environments may be affected; each setup needs checking
- Systems using glibc or non-Linux systems
- PAM-based password checks
- Password authentication disabled
- Red Hat products and Ubuntu’s described build
What reports establish
Exploit activity raises urgency, while the scale of exposure remains unknown.
Patch, restart and review
Confirm every access path before changing authentication settings.
- Check for musl, non-PAM password checks, enabled password authentication and the account conditions.
- Update affected systems to OpenSSH 10.6p2 or a fixed distribution package.
- Restart sshd so the running service uses the fixed code.
- If patching must wait, disable password authentication and confirm key access still works.
- Review authentication logs for password logins to accounts with no password.
How the Password Bypass Changes Risk
The flaw matters because SSH is a common way administrators remotely access Linux servers. Where all the required conditions are present, an attacker who can reach the SSH service may be able to log in to accounts that are meant to have no password login. That can create a path into a server even when an account is intended to accept only key-based access. The risk depends on the machine’s exact software and configuration; the vulnerability is not a general bypass of SSH passwords across Linux.
Administrators should treat reachable, vulnerable SSH servers as a priority, particularly because the source reports public exploit code and a successful sensor observation soon after the fix was released. Alpine warns that root’s default OpenSSH setting, PermitRootLogin prohibit-password, may not protect a system if another accessible account can gain root privileges, such as through passwordless doas. The reported exposure of some Alpine cloud images makes it important to check privilege paths as well as direct root login settings.
For systems that cannot be patched immediately, the source recommends setting PasswordAuthentication no, then checking authentication logs for password logins to accounts that have no password. Disabling password authentication can affect legitimate users, so administrators need to confirm that their access method, such as SSH keys, remains available. A package update alone may also be insufficient: Alpine says administrators must restart sshd so the running daemon uses the fixed code.
Popular right now
Ninja Luxe Café Mini Plus Espresso and Coffee Maker with AutoFroth, Bone & Champagne
De'Longhi Magnifica Duo Fully Automatic Espresso Machine with Milk Frother, Silver
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
As an affiliate, we earn on qualifying purchases.
Which Linux Setups Meet the Conditions
The advisories cited in the source distinguish the vulnerable configuration from other widely used systems. Ubuntu says its OpenSSH build links against glibc and uses PAM, so it is not affected. Red Hat says its products are not affected. Debian’s security tracker rates the issue “unimportant” for its packages and lists upstream version 1:10.6p2-1 as fixed in its unstable branch. Non-Linux systems, systems using glibc, PAM-based password checks, and systems with password authentication disabled are also described as outside the affected set.
Alpine identifies affected account configurations that can include key-only users and, in some cases, root or the default alpine user in official cloud images. It says tiny-cloud images from versions 3.18.11 through 3.24.3 can become exploitable once a $6$ password hash exists on the machine, though they are safe on first boot under the described conditions. The source also names OpenWrt, Buildroot and Yocto as environments that may use musl; that does not establish that every installation of those systems is vulnerable.
The issue also highlights a dispute about where the fault belongs. OpenSSH says the root cause is outside sshd but can be avoided there. Musl maintainer Rich Felker wrote that, in his view, the problem is an erroneous use by the caller rather than a musl bug, while saying musl may change the mechanism in an upcoming release cycle. OpenSSH’s release remains the immediate remediation for affected administrators.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.””
— Alpine Linux security advisory
Exposure Beyond Alpine Remains Unclear
The source identifies Alpine’s standard OpenSSH package as the best-known affected case, but does not provide a count of vulnerable or compromised servers. The extent of exposure in embedded systems also remains uncertain. Medcrypt reported on the oss-security mailing list on November 9 that it had reproduced the issue on a stock Yocto image, but that report does not establish how widely that configuration is deployed.
The reported GreyNoise sensor observation is evidence of a successful break-in on one sensor, not a measure of attacks across the internet or proof of compromise on other systems. The source does not identify the affected account, the consequences of that incident, or how many additional attempts succeeded. Administrators will need to assess their own systems against Alpine’s full list of required conditions rather than assume that a distribution name alone determines risk.
Responsibility for the underlying behavior is disputed between OpenSSH and the musl maintainer. The immediate fix is available in OpenSSH 10.6p2, but the source does not establish when musl might change its behavior or whether that change will affect every downstream build. The outcome of that disagreement does not change the recommendation to patch affected OpenSSH installations.
Patch, Restart and Review SSH Logs
Administrators should first identify whether their servers use musl and run sshd without PAM, then check whether password authentication is enabled and whether the relevant account fields and password hashes are present. Systems meeting all the stated conditions should be updated to OpenSSH 10.6p2 or a fixed distribution package. Alpine says it published fixed packages for branches from edge back to 3.16; administrators should use the package appropriate to their release.
After installing the update, restart sshd so the running daemon is replaced. If an update cannot be applied promptly, disable password authentication and verify that administrators can still access the server through an approved method. Review SSH logs for unexpected password logins, including attempts involving accounts intended to have no password, and investigate any suspicious access through the organization’s incident-response process.
Further clarity may come from distribution advisories, package updates and musl’s next release cycle. Organizations using embedded or custom Linux builds should confirm how their OpenSSH package is linked and configured rather than relying on vendor-level statements for a different build. The supplied source does not give a later remediation deadline or a complete inventory of affected deployments.
Key Questions
What is the OpenSSH SSHole vulnerability?
CVE-2026-123158 is a password-authentication bypass in a specific OpenSSH configuration. On affected Linux systems, an overlong password can cause musl’s crypt() error value to match an asterisk stored for an account with no password.
Are Ubuntu, Debian and Red Hat systems affected?
The source says Ubuntu reports its OpenSSH build is not affected because it uses glibc and PAM, and Red Hat says its products are not affected. Debian rates the issue “unimportant” for its packages. Administrators should still check the advisory for their specific distribution version and build.
What should administrators do first?
Check whether the system meets Alpine’s required conditions, then install OpenSSH 10.6p2 or the distribution’s fixed package and restart sshd. If patching is delayed, disable password authentication and review SSH logs.
Does this flaw affect every Alpine or musl system?
No. The source says the flaw requires a combination of musl, Linux, password checks without PAM, enabled password authentication, a relevant account field and a local $5$ or $6$ password hash. A system using musl is not automatically vulnerable.
Has widespread exploitation been confirmed?
The source reports public exploit code and a successful break-in observed on one GreyNoise sensor. It does not provide a count of compromised servers or establish widespread compromise.
Source: ThorstenMeyerAI.com
