🔍 Read the full analysis: OpenSSH SSHole Bug: How To Assess Your Linux Server Exposure on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
OpenSSH’s CVE-2026-123158, nicknamed “SSHole,” can bypass password checks on a narrow set of Linux systems using musl, without PAM, with password authentication enabled. OpenSSH released a fix in version 10.6p2; administrators should update and restart sshd or disable password authentication, then review login logs.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a password-authentication bypass affecting specific Linux servers that use the musl C library and run sshd without PAM. The flaw, dubbed “SSHole” by its finder, could let a remote attacker access certain password-locked accounts using an unusually long password; administrators should check whether their systems meet all the affected conditions.
The issue is not a general flaw in every OpenSSH installation. According to Alpine Linux’s advisory, exploitation requires a particular combination: Linux with musl libc, password checks handled without PAM, and PasswordAuthentication enabled. The system must also have an account whose password field contains an asterisk and at least one local account with a password hash beginning $5$ or $6$. Alpine’s standard openssh-server package is a prominent example of a configuration to check.
The failure involves how the password check handles very long input. Alpine says musl’s crypt() function returns an asterisk as an error indicator for a password exceeding 256 bytes. In the affected setup, that result can match the asterisk stored for an account with no password, allowing authentication to succeed. The advisory says a password of 257 to 1,024 bytes can trigger the issue under the required conditions.
OpenSSH released the correction as 10.6p2. GreyNoise and BleepingComputer reported that exploit code became public about four hours after the release, while GreyNoise said its sensors recorded a first successful break-in about 40 hours after release. CISA added the vulnerability to its exploited-vulnerabilities list on November 9. Those reports indicate active exploitation has been observed, but do not establish that every exposed system has been attacked.
OpenSSH SSHole Bug Assess your server exposure
SSHole can bypass password checks on a narrow set of musl-based Linux systems. Exposure depends on the server’s library, authentication setup and local account records.
Check every exposure condition
The bypass requires all of these conditions; an OpenSSH installation alone does not indicate exposure.
- Linux uses musl libc.
- sshd checks passwords without PAM.
- PasswordAuthentication is enabled.
- An account has an asterisk in its password field.
- At least one local password hash begins with $5$ or $6$.
How the bypass can happen
In the affected setup, an overlong password can make musl’s crypt() return an asterisk, matching the marker stored for an account without a usable password.
A remote attacker reaches SSH and submits unusually long input.
The returned asterisk can match the account’s stored password field.
Under the required conditions, password authentication can be bypassed.
Distribution guidance
Vendor statements apply to their own builds and configurations. Custom and embedded systems need checks against the technical conditions.
| System or build | Reported guidance |
|---|---|
| Ubuntu OpenSSH | Not vulnerable; uses glibc and PAM |
| Red Hat products | Reported not affected |
| Debian packages | Tracker rates the issue unimportant |
| Custom or embedded builds | Verify library, PAM, settings and account records |
| Alpine tiny-cloud images 3.18.11–3.24.3 | Check carefully; qualifying hashes can make them exploitable |
Patch, restart and review
Treat remediation and log review as operational priorities; public exploit code and reported exploitation followed the fix.
Install the patched package
Use your distribution’s fixed OpenSSH package, including the upstream fix in 10.6p2.
Confirm sshd is patched
Restart the daemon after installation and verify it is running the fixed version.
Disable password authentication
If an update must wait, set PasswordAuthentication no where operationally appropriate and confirm the effective configuration.
Inspect authentication logs
Investigate unexpected successful password logins to accounts with an asterisk password field.
Why Musl-Based Servers Need Checks
The flaw matters because SSH is a common remote administration route, and the affected authentication path can turn a nominally locked account into a potential entry point. Alpine warns that an attacker who can reach the SSH service may be able to log in without knowing a valid password, if all required conditions are present. On systems where that account can gain elevated privileges, the consequences could extend beyond the initial account.
Administrators should not infer exposure from the OpenSSH name alone. Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable to this issue; Red Hat also says its products are not affected. Debian’s tracker rates the issue unimportant for its packages. Those statements concern the distributions’ own builds and configurations; custom, embedded or locally modified systems still need to be checked against the technical conditions.
The response also highlights a changing security timeline. The source reports that public exploit code followed the patch by hours and that a sensor later recorded a successful attack. For operators, the practical implication is to treat patching and log review as immediate operational tasks, rather than assuming a newly released fix will precede attempts to exploit the bug.
Popular right now
Vitamix VX1 Professional-Grade Blender, 64 oz, Black
Dyson Ball Animal 3 Upright Vacuum
Dyson V15 Detect Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
How the Password Check Failed
Linux account records commonly use a special marker rather than a usable password hash for accounts that should not accept password logins. In the affected OpenSSH path, sshd checks a supplied password with the system’s crypt() function and compares the result with the stored field. Alpine’s explanation is that musl’s error return for overlong input can look identical to the asterisk marker in that field.
Responsibility for the underlying behavior is disputed. OpenSSH says the root cause is outside sshd, although it is exploitable through sshd and can be avoided there. Musl maintainer Rich Felker described the issue on the musl mailing list as an erroneous use by the caller rather than a musl bug, while saying musl may change the mechanism in an upcoming release cycle. The OpenSSH patch addresses the exposure at the server side.
Alpine identifies its official tiny-cloud images from versions 3.18.11 through 3.24.3 as a configuration requiring particular attention: they include an alpine user with an asterisk password field and passwordless doas. Alpine says those images are safe on first boot but can become exploitable once a qualifying $6$ hash exists on the machine. Root’s usual OpenSSH setting, PermitRootLogin prohibit-password, does not necessarily protect a different account that can become root.
““An attacker who can reach your SSH port can log in without knowing any password.””
— Alpine Linux advisory
Which Custom Builds Are Exposed
Exposure in embedded and customized Linux environments is less settled than for the named distribution packages. The source reports that Medcrypt said on the oss-security mailing list on November 9 that it independently reproduced the issue, including on a stock Yocto image. That report signals that some embedded deployments warrant testing, but it does not establish that every Yocto or Buildroot system is vulnerable.
It is also not clear from the available reporting how many systems have been compromised, how broadly attackers are scanning, or whether observed attacks have affected particular organizations. CISA’s listing and GreyNoise’s sensor observation show exploitation activity was reported; they do not quantify the overall impact. Administrators should verify their own package, library, PAM use, password settings and account records rather than relying on an operating-system label alone.
Patch, Restart and Review Logs
Administrators should install the fixed OpenSSH package for their system and restart sshd. Alpine says fixed packages are available across its branches, including older branches, and advises running apk upgrade -U -a. Package installation alone does not replace an already running daemon, so confirm that the service has restarted and is using the patched version.
If an update cannot be applied immediately, set PasswordAuthentication no where operationally appropriate, then confirm the effective sshd configuration. Review authentication logs for password logins to accounts whose stored password field is an asterisk, and investigate any unexpected successful access. Continue to track vendor advisories for distribution-specific fixes and configuration guidance, especially for embedded images and custom builds.
Key Questions
Does SSHole affect every Linux server running OpenSSH?
No. The reported bypass requires a specific combination: Linux using musl, sshd checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and at least one local $5$ or $6$ password hash.
Which OpenSSH version fixes CVE-2026-123158?
OpenSSH 10.6p2 contains the upstream fix. Administrators should use the patched package supplied for their distribution and restart sshd after installation.
Are Ubuntu, Debian and Red Hat systems affected?
The cited advisories say Ubuntu’s OpenSSH builds are not affected because they use glibc and PAM, and Red Hat says its products are not affected. Debian’s tracker rates the issue unimportant for its packages. Custom builds and altered configurations should be checked separately.
What can administrators do before they can patch?
Where appropriate, disable password-based SSH logins by setting PasswordAuthentication no. Administrators should verify the effective configuration, plan a patch, and review authentication logs for unexpected password logins to accounts with an asterisk password field.
Does installing the updated package finish remediation?
Not by itself. Alpine warns that the running daemon must be restarted to load the updated OpenSSH code. Confirm the service is running the patched version after the restart.
Source: ThorstenMeyerAI.com
