TL;DR
OpenSSH fixed CVE-2026-123158, nicknamed “SSHole,” in version 10.6p2 on November 5, 2026. The password bypass requires a specific combination of Linux, musl, SSH password authentication and account settings; Alpine Linux is the best-known affected case. Administrators should update or disable password authentication and review logs.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a password authentication bypass that can let attackers access certain Linux accounts with an overlong password. The vulnerability, nicknamed “SSHole,” affects only systems meeting several conditions, including use of the musl C library and password authentication without PAM; Alpine Linux is the best-known affected case.
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The flaw occurs when OpenSSH’s server, sshd, checks a password without PAM and uses the C library’s crypt() function. Alpine Linux’s advisory says musl returns the string * as an error indicator when a password exceeds 256 bytes. On affected systems, that value can match the stored password field used for accounts that have no password, allowing authentication to succeed. The source says the relevant password input is between 257 and 1,024 bytes.
The bypass requires more than an exposed SSH service. According to Alpine’s advisory, the system must run Linux with musl, check passwords without PAM, have PasswordAuthentication enabled, include an account whose password field is *, and have at least one local account with a $5$ or $6$ password hash. The advisory says a single account with a password hash can be enough to satisfy that last condition.
OpenSSH released the fix as 10.6p2. GreyNoise and BleepingComputer reported that public exploit code appeared about four hours after the release, and GreyNoise said one of its sensors saw a successful break-in about 40 hours after release. CISA added the issue to its list of exploited vulnerabilities on November 9. Those reports make prompt remediation relevant for administrators whose systems meet the affected conditions.
Exposure Depends on SSH Configuration
The bug shows how an error value from a system library can become an authentication decision when a calling program compares it with stored account data. For administrators, the practical risk is concentrated: an internet-reachable SSH service may permit access to accounts designed to have no password, but only when the listed software and configuration conditions align.
Alpine warns that root’s default OpenSSH restriction, PermitRootLogin prohibit-password, does not necessarily remove the risk if another accessible account can gain root privileges, for example through doas. Alpine’s advisory specifically identifies official tiny-cloud images from versions 3.18.11 through 3.24.3 as safe on first boot but potentially exploitable once a qualifying $6$ hash exists. That makes it important to check the full authentication path and local account setup, not just whether direct root login is disabled.
The reported exploitation timeline also narrows the time between disclosure and practical risk: exploit code reportedly appeared within hours, while CISA’s November 9 listing records exploitation as an active concern. These reports do not establish that every system was targeted, but they support treating affected deployments as urgent patching candidates.
Products Worth Considering
DJI Mini 5 Pro Fly More Combo with DJI RC 2
Kindle Paperwhite Signature Edition 32GB E-Reader, 7-Inch Display, Seaglass Green
Logitech MX Mechanical Wireless Illuminated Keyboard, Clicky Switches
As an affiliate, we earn on qualifying purchases.
Why the Asterisk Matters
On Linux, a stored password field containing an asterisk commonly indicates that an account cannot authenticate with a password. The account may still be usable with an SSH key or another access method. In the affected path described by Alpine, musl’s error marker for an overlong password is also an asterisk. Because the returned marker and the account field can match, a failed password-hash operation can be mistaken for a successful comparison.
OpenSSH said the root cause was outside sshd, while also saying the issue could be avoided in sshd. Musl maintainer Rich Felker took a different view, describing the behavior as an erroneous use by the caller and saying musl might change the mechanism in an upcoming release cycle. The immediate OpenSSH fix addresses the exploitable path through the server.
According to the supplied advisories, systems using glibc, PAM-based password checks, or disabled SSH password authentication are not affected by this issue. Ubuntu said its OpenSSH uses glibc and PAM and is not vulnerable; Red Hat said its products are not affected. Debian’s security tracker rates the issue “unimportant” for its packages and lists upstream version 1:10.6p2-1 as fixed in its unstable branch. These statements concern the named distributions and configurations, not every possible Linux build.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.””
— Alpine Linux advisory
Embedded Builds Need Checking
The advisories identify a narrow set of conditions, but the supplied material does not establish how many internet-connected systems meet them. Embedded Linux deployments may use custom combinations of musl, OpenSSH and authentication settings, so distribution names alone may not answer whether a device is vulnerable.
Medcrypt reported on the oss-security mailing list on November 9 that it independently reproduced the issue, including on a stock Yocto image. That report indicates the possible reach extends beyond Alpine, but the supplied information does not identify which Yocto configurations or products are affected. The dispute over whether the underlying error belongs to musl or its caller also remains open.
Patch and Review SSH Access
Administrators should install OpenSSH 10.6p2 or a distribution-provided fix and restart sshd, following their system vendor’s instructions. If an update is not immediately available, the source material recommends setting PasswordAuthentication no. Teams should also review SSH authentication logs for password logins to accounts that have no password and check whether any such account can gain elevated privileges.
Operators of Alpine, OpenWrt, Buildroot, Yocto and other musl-based systems should confirm their actual library, PAM use, SSH settings and account fields. Further vendor advisories and any musl changes may clarify affected embedded configurations. The supplied material does not specify a deadline or a complete list of affected products.
Key Questions
What is the OpenSSH SSHole bug?
CVE-2026-123158 is a password authentication bypass in a specific OpenSSH configuration. An overlong password can cause musl’s crypt() function to return an asterisk that matches the stored field for an account with no password.
Which systems are affected?
Systems are affected only when several conditions align: Linux with musl, OpenSSH checking passwords without PAM, password authentication enabled, an account with a * password field, and a local $5$ or $6$ password hash. Alpine Linux is the best-known case; embedded builds need configuration-specific review.
Are Ubuntu, Debian and Red Hat affected?
Ubuntu said its OpenSSH builds use glibc and PAM and are not vulnerable; Red Hat said its products are not affected. Debian’s tracker rates the issue “unimportant” for its packages and lists a fixed version in its unstable branch. Check the advisory for the specific distribution release in use.
How can administrators reduce the risk?
Update to OpenSSH 10.6p2 or the vendor’s patched package and restart sshd. If that cannot be done promptly, disable password authentication with PasswordAuthentication no and review logs for password logins to accounts with no password.
Source: Thorsten Meyer AI
