🔍 Read the full analysis: OpenSSH SSHole: What To Know About The Overlong-Password Bug on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
OpenSSH fixed CVE-2026-123158, nicknamed “SSHole,” in version 10.6p2. The password-authentication bypass affects only specific Linux setups using musl, no PAM for SSH password checks, and other required account and configuration conditions; administrators should update and restart sshd or disable password authentication.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a password-authentication bypass nicknamed “SSHole.” The flaw can let an attacker log in to certain accounts by sending an overlong password, but only on Linux systems meeting several conditions, including use of the musl C library and SSH password checks without PAM. GreyNoise reported a successful break-in on one of its sensors about 40 hours after the fix was released.
The bug involves how sshd checks passwords on affected systems. Alpine Linux’s advisory says musl’s crypt() function returns an asterisk as an error indicator when a password exceeds 256 bytes. Some accounts that are not meant to accept password logins also have an asterisk in the password field. In the vulnerable configuration, the error result can match that field, allowing the login check to succeed. The reported attack uses a password between 257 and 1,024 bytes.
The bypass is not present on every Linux server. Alpine’s advisory lists several conditions that must all be met: OpenSSH must run on Linux with musl; password checks must run without PAM; password authentication must be enabled; an account must have an asterisk in its password field; and a local account must have a $5$ or $6$ password hash. Alpine’s standard openssh-server package is a prominent affected configuration. The researcher also identified possible exposure in systems built with OpenWrt, Buildroot or Yocto, depending on configuration.
OpenSSH published 10.6p2 as the fix. GreyNoise and BleepingComputer reported that exploit code appeared publicly about four hours after the release, while GreyNoise said it saw its first successful break-in roughly 40 hours after release. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its list of exploited vulnerabilities on November 9. These reports indicate exploitation, but the supplied information does not establish how many systems or organizations were compromised.
OpenSSH SSHole What to know about the overlong-password bug
OpenSSH 10.6p2 fixes a password-authentication bypass that affects only specific Linux configurations. Administrators should check their setup, update and restart sshd, or temporarily disable password authentication.
When the bypass can work
The required conditions must coincide; OpenSSH servers are not all affected.
The server runs OpenSSH on Linux using the musl C library.
SSH password authentication is enabled and checks run without PAM.
The account has an asterisk in its password field and a local $5$ or $6$ password hash.
How the password check fails
On affected systems, an overlong password can make an error value look like a match.
- The reported attack uses a password between 257 and 1,024 bytes.
- musl’s crypt() returns an asterisk as an error indicator for this input.
- An asterisk can also mark an account without a usable password.
- In the vulnerable configuration, the error result can match that field and allow login.
Check your system’s exposure
Verify the actual operating system, SSH package and authentication settings.
| Setup | What the supplied advisories say |
|---|---|
| Linux with musl and all required conditions | Potentially affected |
| Ubuntu OpenSSH build | Not affected; linked against glibc and uses PAM |
| Red Hat products | Not affected |
| Non-Linux systems, Dropbear, or containers without sshd | Outside the described affected setup |
| OpenWrt, Buildroot or Yocto systems | Depends on configuration |
Patch and investigate
Install the fix
Install OpenSSH 10.6p2 or a fixed distribution package for your branch.
Replace the running daemon
Restart sshd after upgrading; the package update alone does not replace an already running daemon.
Disable password authentication
If an update must wait, set PasswordAuthentication no where operationally appropriate.
Check logs and privileges
Look for password logins to accounts that should not accept them, and review paths to elevated privileges.
A Narrow Bug With Serious Access
For an affected server, the issue can turn a network-accessible SSH service into a route to accounts that administrators expected to be locked against password login. Alpine says the attack needs one connection and no retries. If an account reached this way can gain higher privileges, the consequences could extend beyond that user; Alpine specifically warns that a separate account with permission to become root may create a path to full system access.
The practical risk is concentrated rather than universal. Ubuntu says its OpenSSH build is linked against glibc and uses PAM, and Red Hat says its products are not affected. That distinction matters for response: administrators should verify their actual operating system, SSH package and authentication configuration rather than assume every OpenSSH installation is vulnerable—or dismiss the issue because a major distribution is unaffected. The appearance of public exploit code soon after the patch also makes prompt remediation important for systems that do meet the conditions.
Popular right now
Ninja Crispi Microwave and Air Fryer with FusionCrisp, Silver, MW101
Shark ZU102 Rotator Pet Upright Vacuum with PowerFins HairPro & Odor Neutralizer Technology, Charcoal
Dyson Ball Animal 3 Upright Vacuum
As an affiliate, we earn on qualifying purchases.
How the Password Check Failed
In the affected setup, OpenSSH asks the system’s crypt() function to process a supplied password and compares the result with the account’s stored password field. Alpine’s advisory explains that musl returns “*” for an overlong input, while that same character can mark an account with no usable password. The error indicator is therefore treated like a matching password result in this particular code path.
Responsibility for the underlying behavior is disputed. OpenSSH said the root cause is outside sshd, though it is exploitable through sshd and can be avoided there. Musl maintainer Rich Felker said he considers the problem an erroneous use by the caller, rather than a musl bug, while indicating the mechanism may change in a future release cycle. OpenSSH’s patch addresses the issue at the server level.
The vulnerability is tracked as CVE-2026-123158 and is rated 8.1, “High,” in the supplied source material. Systems using glibc, password checks through PAM, or password authentication disabled are listed as not affected by this issue. Non-Linux systems, Dropbear, and containers that do not run sshd inside them are also outside the affected setup described in the advisories.
“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”
— Alpine Linux security advisory
Exposure Beyond Known Builds
The full number of vulnerable installations and confirmed intrusions is not given in the source material. GreyNoise’s sensor observation establishes that it saw a successful break-in, but it does not show how widespread exploitation is or whether other victims have been identified. It is also not clear which individual OpenWrt, Buildroot or Yocto deployments are vulnerable without checking their specific libraries, SSH configuration and account records.
There is also a difference of view over whether the underlying defect belongs to musl or to the way sshd uses it. OpenSSH has shipped a server-side fix, while Felker said musl may change its behavior in a future release cycle. The source material does not specify when such a change would arrive.
Patch, Restart and Review Logs
Administrators should install OpenSSH 10.6p2 or a distribution package containing the fix, then restart sshd. Alpine warns that upgrading the package alone does not replace a daemon that is already running. Alpine says fixed packages are available across its listed branches, including branches back to 3.16; administrators should check the package version for their own branch rather than rely only on the upstream version number.
If an immediate update is not possible, set PasswordAuthentication no as a temporary measure, where operationally appropriate. Administrators should also review authentication logs for password logins to accounts that have no password, and examine whether any reachable account can gain elevated privileges. The source material does not provide a specific log query or a confirmed incident count, so investigation should follow local logging and incident-response procedures.
Key Questions
What is the OpenSSH SSHole vulnerability?
CVE-2026-123158 is a password-authentication bypass. On systems meeting specific conditions, an overlong password can trigger an error value that matches the stored field for an account with no usable password.
Does the bug affect every OpenSSH server?
No. The reported vulnerability requires a particular combination, including Linux with musl, SSH password checks without PAM, password authentication enabled, a relevant account field, and a local $5$ or $6$ password hash. Ubuntu and Red Hat said their builds or products are not affected.
How should administrators fix it?
Install OpenSSH 10.6p2 or a fixed distribution package and restart sshd. If updating must wait, disable password authentication where feasible and review logs for suspicious password logins to accounts that should not accept them.
Has the vulnerability been exploited?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the fix was released. CISA added the flaw to its exploited-vulnerabilities list on November 9. The available information does not establish the total number of affected systems or victims.
Source: ThorstenMeyerAI.com
