TL;DR
Get everyday essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
OpenSSH fixed a high-severity password authentication flaw, CVE-2026-123158, in version 10.6p2 on November 5. The bug affects a narrow set of Linux servers using musl without PAM when password authentication is enabled; exploit code appeared within hours, and CISA added the flaw to its exploited vulnerabilities list on November 9.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a high-severity flaw that can let an attacker log in to certain Linux accounts using an overlong password. The bypass applies only under specific conditions, including systems using the musl C library, OpenSSH password checks without PAM, and password authentication enabled. CISA added the vulnerability to its exploited vulnerabilities list on November 9.
The flaw, rated 8.1, or High, is also called “sshole” by the researcher who reported it. According to Alpine Linux’s advisory, musl’s crypt() function returns an asterisk as an error indicator when a password is longer than 256 bytes. On affected systems, that can match the asterisk stored for accounts that have no password, making the failed password check appear successful. The described attack uses a password between 257 and 1,024 bytes.
Alpine says the issue requires more than a musl-based system: sshd must check passwords without PAM, PasswordAuthentication must be enabled, an account must have an asterisk in its password field, and at least one local account must have a password hash beginning with $5$ or $6$. Alpine’s standard openssh-server package is a prominent example of an affected configuration. The advisory says an attacker who can reach the SSH service may be able to log in to accounts with the asterisk field.
Exploit code became public about four hours after the fix, according to GreyNoise and BleepingComputer. GreyNoise reported its first successful break-in on one of its sensors roughly 40 hours after the release. These reports indicate observed exploitation, but the source material does not establish how widespread attacks are or how many systems were compromised.
SSH Access at Risk on Some Builds
SSH is a common way for administrators to manage Linux servers remotely. On a system that meets the advisory’s conditions, an attacker who can connect to its SSH port may bypass password authentication for an account whose stored password field is an asterisk. If that account can gain elevated privileges, the impact could extend beyond the initial account.
The affected configuration is limited, but it can occur in embedded and lightweight Linux deployments. Alpine specifically warns about certain official tiny-cloud images, where an alpine account and passwordless doas can create a route to elevated access once a qualifying password hash exists. Administrators should check their actual libc, PAM, SSH and account configuration rather than assume every Linux server is exposed or that every Alpine installation has the same risk.
Products Worth Considering
Logitech MX Mechanical Wireless Illuminated Keyboard, Tactile Quiet, Graphite
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Bose QuietComfort Headphones (2nd Gen), Wireless Over-Ear Noise-Cancelling Headphones, Black
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
For accounts that should not accept password logins, a stored asterisk is commonly used as a value that no real password can match. In the affected path, sshd calls the C library’s crypt() function to check the submitted password and compares its result with the stored field. Alpine’s advisory says that for an overlong input, musl returns an asterisk error indicator. Because that is also the stored value for some accounts, the error can be mistaken for a match.
Responsibility for the underlying behavior is disputed. OpenSSH says the root cause is outside sshd, though sshd can avoid the exploitable behavior. Musl maintainer Rich Felker said he considers the problem an erroneous use by the caller rather than a musl bug, and said musl may change the mechanism in an upcoming release cycle. OpenSSH’s fix provides a way to address the issue at the server level.
Distribution advisories describe different exposure. Ubuntu says its OpenSSH is linked against glibc and uses PAM, so it is not vulnerable; Red Hat says its products are not affected. Debian’s tracker rates the issue unimportant for its packages and lists the fixed upstream version in its unstable branch. Alpine identifies affected configurations, while Medcrypt reported reproducing the issue on a stock Yocto image. The Yocto report suggests embedded builds warrant separate checks.
““We consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there.””
— OpenSSH
Exposure Depends on Local Configuration
The affected population is not established by the available source material. The flaw depends on the combination of musl, sshd password checks without PAM, enabled password authentication and particular account password fields and hashes. The report of reproduction on a stock Yocto image raises questions about embedded deployments, but does not identify the full range of affected products or configurations.
It is also unclear how many successful attacks occurred beyond the sensor observation reported by GreyNoise, or whether any particular organization’s systems were compromised. OpenSSH and musl maintain different views of where the root cause lies, and the timing or scope of any musl change is not specified.
Patch and Review SSH Settings
Administrators should update to OpenSSH 10.6p2 or a distribution package containing the fix, then restart sshd as directed by their system’s package guidance. If they cannot update immediately, Alpine’s guidance is to set PasswordAuthentication no where password-based SSH access is not required.
Teams should confirm whether their systems use musl, whether sshd checks passwords without PAM, and whether password authentication is enabled. They should also review accounts with an asterisk password field and check SSH logs for password logins to accounts that should not accept passwords. Embedded Linux vendors and operators should consult their distribution or build provider for affected versions and remediation status.
Key Questions
What is the OpenSSH SSHole vulnerability?
CVE-2026-123158 is a password authentication bypass in certain Linux OpenSSH configurations. An overlong password can trigger a musl error response that matches the asterisk stored for some accounts that have no password.
Which systems are affected?
Systems are exposed only when the required conditions align: Linux with musl, sshd checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and at least one local $5$ or $6$ password hash. Alpine’s standard openssh-server package is a known case; embedded configurations should be checked individually.
Are Ubuntu and Red Hat systems affected?
Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable. Red Hat says its products are not affected. Administrators should still follow their distribution’s security notices for the packages and versions they run.
How can administrators reduce the risk?
Install OpenSSH 10.6p2 or a distribution package with the fix, then restart sshd as appropriate. If a patch is not available, disable password authentication where possible and review SSH logs and account configurations.
Source: Thorsten Meyer AI
