🔍 Read the full analysis: The OpenSSH SSHole Bug Explained For Linux Server Operators on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
The OpenSSH flaw CVE-2026-123158, nicknamed “SSHole,” can allow passwordless login under a narrow set of Linux configurations using musl, without PAM, and with password authentication enabled. OpenSSH released version 10.6p2 on November 5, 2026; operators should update and restart sshd or disable password authentication while patching. Exploitation has been reported, but exposure depends on account and system details.
OpenSSH 10.6p2, released November 5, fixes CVE-2026-123158, a flaw that can let an attacker log in to certain Linux accounts without a valid password. The issue, nicknamed “SSHole,” affects systems using the musl C library when sshd checks passwords without PAM and password authentication is enabled; reports say attackers began exploiting it soon after the fix became public.
The bypass depends on how OpenSSH’s sshd handles password checks alongside musl’s crypt() function. Alpine Linux’s advisory says musl returns an asterisk (*) as an error indicator when a supplied password exceeds 256 bytes. On affected systems, that can match the asterisk stored for accounts with no password, making a failed password check appear successful. The supplied password length described in the source is 257 to 1,024 bytes.
The conditions are specific: sshd must run on Linux with musl, check passwords without PAM, and have PasswordAuthentication enabled. The source also identifies an account whose password field is * and at least one local account with a $5$ or $6$ password hash as relevant conditions. Alpine’s standard openssh-server package is a prominent example. Operators should check their actual build and configuration rather than infer exposure from the distribution name alone.
OpenSSH issued the fix as version 10.6p2. The source says GreyNoise and BleepingComputer reported that exploit code appeared about four hours after the release, and GreyNoise recorded a first successful break-in on one of its sensors about 40 hours after release. CISA added the vulnerability to its exploited-vulnerabilities list on November 9. These reports indicate exploitation, but do not establish that any particular server has been compromised.
OpenSSH’s SSHole bug what server operators need to know
CVE-2026-123158 can bypass password checks on Linux servers with a specific combination of musl, PAM, and account settings. Check your configuration, patch, and restart sshd.
When the bypass can work
Exposure depends on the server build, authentication settings, and local account records.
The server runs Linux with the musl C library.
PasswordAuthentication is enabled and password checks run without PAM.
Relevant conditions include an account marked with * and at least one local $5$ or $6$ password hash.
How an error can look like success
On affected systems, musl’s error marker can match an account’s stored marker for no usable password.
- sshd checks the submitted password using crypt().
- An overlong input can make musl return * as an error indicator.
- An account with * in its password field may produce the same string.
- The failed check can appear successful, allowing passwordless login.
Who should review their systems
Distribution names alone do not establish whether a particular server is exposed.
| System or environment | What the source reports |
|---|---|
| Alpine Linux | Standard openssh-server is a prominent affected case; verify the exact build and configuration. |
| OpenWrt, Buildroot, Yocto | May warrant checks; scope across deployments is not established. |
| Debian, Ubuntu, Red Hat | Report their OpenSSH builds are not affected; follow distribution advisories. |
Patch, restart, then investigate
Apply the fix promptly and confirm the running daemon uses it.
- Install OpenSSH 10.6p2 or your distribution’s fixed package.
- Restart sshd; upgrading the package alone may leave the old daemon running.
- If you cannot update immediately, temporarily set PasswordAuthentication to no.
- Review authentication logs for unexpected password logins to accounts with no password, and check whether affected accounts can gain elevated privileges.
Exposure Depends on Server Configuration
For operators of affected servers, the flaw turns a normally locked account into a possible entry point through the exposed SSH service. Alpine warns that one account with a password can provide the hash salt needed for the check, while accounts with an asterisk password field may then be vulnerable. A compromised account could create further risk if it can use privilege escalation tools such as passwordless doas.
The reported speed from fix release to public exploit code shortens the time available to patch exposed systems. Still, the affected configuration is not universal: the source says Debian, Ubuntu and Red Hat report their OpenSSH builds are not affected. Operators should confirm their libc, PAM use, authentication settings and account records before deciding their risk.
Products Worth Considering
Apple Watch SE 3 GPS 40mm Smartwatch
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Asterisk Match Occurs
On affected systems, sshd checks a submitted password by using the system’s crypt() function and comparing the result with the account’s stored password field. An asterisk commonly marks an account that has no usable password. Alpine’s explanation is that, for an overlong input, musl also returns an asterisk to signal an error. The matching strings can lead to a successful login instead of a rejected password.
Responsibility for the underlying behavior is disputed. OpenSSH says the root cause is outside sshd but can be avoided there. Musl maintainer Rich Felker said he views the issue as “an erroneous use by the caller,” while also saying musl may change the mechanism in an upcoming release cycle. The immediate operator response is the OpenSSH patch, not waiting for that separate change.
The source identifies Alpine Linux as the best-known affected case and names OpenWrt, Buildroot and Yocto as environments that may warrant checks. Ubuntu says its OpenSSH is linked against glibc and uses PAM; Red Hat says its products are not affected. Debian lists the issue as “unimportant” for its packages and identifies upstream version 1:10.6p2-1 as fixed in its unstable branch.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long.””
— Alpine Linux security advisory
Which Systems Still Need Review
It is not clear from the available reporting how many internet-facing systems meet all the required conditions or how many have been compromised. GreyNoise’s reported observation came from one sensor; it should not be read as a count of affected servers or intrusions. The source also notes uncertainty in embedded deployments: Medcrypt said it independently reproduced the issue on a stock Yocto image, but the scope across Yocto-based products is not established.
Operators must also determine whether their exact OpenSSH build, PAM configuration, account database and password fields satisfy the conditions. Alpine’s warning about tiny-cloud images describes particular releases and configurations; it does not establish that every Alpine installation is exposed. The source lists Alpine image releases 3.18.11 through 3.24.3 as shipping an alpine user with an asterisk password and passwordless doas, with exposure arising once a qualifying $6$ hash exists.
Patch, Restart and Check Logs
Operators should install OpenSSH 10.6p2 or a distribution-provided fixed package, then restart sshd so the running daemon uses the patched code. Alpine says it published fixed packages across branches from edge back to 3.16. Its advisory cautions that upgrading the package alone does not replace the running daemon. Package names and update commands vary, so administrators should follow their distribution’s security notice.
If an immediate update is not possible, the source recommends setting PasswordAuthentication no as a temporary mitigation. Administrators should then review authentication logs for password logins to accounts with no password and investigate any unexpected access. They should also check whether affected accounts can gain elevated privileges. The available source does not specify a universal log query or retention period, so review procedures will depend on each system.
Further clarity may come from distribution advisories, fixes in musl, and investigation of embedded deployments. Until then, operators should verify systems against the full set of conditions and treat reported exploitation as a reason to act promptly, not as proof that a particular host was accessed.
Key Questions
What is the OpenSSH SSHole flaw?
CVE-2026-123158 is a password-authentication bypass involving OpenSSH and musl. Under specific conditions, an overlong password can trigger an error value that matches the stored marker for an account with no password.
Which Linux servers may be affected?
Servers running Linux with musl may be affected if sshd checks passwords without PAM, password authentication is enabled, and the relevant account and password-hash conditions are present. Alpine’s standard openssh-server package is the best-known case in the source material.
Are Debian, Ubuntu and Red Hat affected?
The source says Debian, Ubuntu and Red Hat report their OpenSSH builds are not affected. Ubuntu cites its use of glibc and PAM; administrators should still follow their distribution’s own advisories and package updates.
How should operators respond?
Install OpenSSH 10.6p2 or the fixed package provided by the distribution, then restart sshd. If patching must wait, disable password authentication and review logs for unexpected password logins to accounts with no password.
Does a report of exploitation mean my server was compromised?
No. GreyNoise reported a successful break-in on one sensor, and CISA listed the flaw as exploited. Those reports do not show that any specific server was accessed; operators need to inspect their own exposure and logs.
Source: ThorstenMeyerAI.com
