🔍 Read the full analysis: OpenSSH SSHole: A Password Bug With Real-World Linux Server Attacks on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
OpenSSH flaw CVE-2026-123158 can bypass password checks on a narrow set of Linux systems using musl, without PAM, with password authentication enabled. Public exploit code appeared about four hours after the November 5 fix, GreyNoise recorded a successful attack roughly 40 hours after release, and CISA added the flaw to its exploited-vulnerabilities list on November 9.
A flaw in OpenSSH has enabled attackers to log in without a valid password to certain Linux accounts, and security monitors have recorded a successful intrusion. The vulnerability, CVE-2026-123158, affects a limited configuration using the musl C library; OpenSSH released a fix on November 5, but exploit code appeared within hours.
The issue, called “*sshole” by its finder, is rated 8.1, or High, in the source material. It is not a general bypass affecting every OpenSSH server. The vulnerable combination is Linux running OpenSSH with musl, password checking that does not use PAM, and password authentication enabled. The account being targeted must also have an asterisk in its password field, and another local account must have a qualifying password hash.
Alpine Linux’s advisory describes the underlying failure: on affected systems, musl’s crypt() function returns an asterisk as an error indicator when given a password longer than 256 bytes. Because an asterisk is also used in some account records to mark an account with no usable password, the failed check can appear to match the stored value. A suitably long password—reported as 257 to 1,024 bytes—can then pass the check under the necessary conditions.
According to GreyNoise and BleepingComputer, exploit code became public about four hours after the OpenSSH fix was released. GreyNoise reported seeing the first successful break-in on one of its sensors about 40 hours after release. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its list of exploited vulnerabilities on November 9.
SSHole: A password bug with real-world attacks
A narrow OpenSSH configuration can allow passwordless login. Successful attack activity makes prompt patching and log review important for affected administrators.
When the bypass applies
Exposure depends on several conditions being present together.
Linux must use the musl C library.
Password authentication must be enabled and password checks must run without PAM.
The target account has an asterisk in its password field, and another local account has a qualifying password hash.
A narrow but serious flaw
A long password can trigger an error value that looks like the target account’s stored asterisk.
- Linux systems using musl
- OpenSSH password checks without PAM
- Password authentication enabled
- Qualifying account records present
- glibc-based Linux systems
- PAM-based password checks
- Password authentication disabled
- Non-Linux systems and Dropbear
Patch and verify access
Installing the package alone does not replace an SSH daemon already running in memory.
Install the fixed release
Use OpenSSH 10.6p2 where applicable, or the fixed package for your distribution branch.
Restart sshd
Restart the SSH daemon so the patched code is running.
Check configuration and logs
Verify libc, PAM, SSH settings and account records. If patching must wait, disable PasswordAuthentication and review relevant login logs.
Why Affected SSH Servers Need Action
SSH is a common way administrators remotely manage servers, so a password bypass can put accounts and the systems they can access at risk. The exposure is especially relevant where a nominally locked account can obtain higher privileges through another route. Alpine warned that its official tiny-cloud images in versions 3.18.11 through 3.24.3 can become exploitable once a qualifying password hash exists; in those images, the alpine account can use passwordless doas to gain elevated access.
The reported attack activity makes this more than a theoretical defect for systems that meet the conditions. Administrators should identify whether their servers use the affected configuration, install the patched package, and restart the SSH daemon. Where an update cannot be applied promptly, the source recommends disabling PasswordAuthentication and reviewing logs for password logins to accounts with no password.
The incident also highlights a short response window: public exploit code followed the patch within hours, while the first sensor-recorded successful intrusion came less than two days after release. Those timings are observations reported by the named sources, not a measure of how many servers were attacked or compromised overall.
Popular right now
LG 77-Inch OLED evo C6 4K Smart TV
Ninja Crispi Microwave and Air Fryer with FusionCrisp, Silver, MW101
Bose QuietComfort Wireless Noise-Cancelling Headphones, Sandstone
As an affiliate, we earn on qualifying purchases.
The musl and OpenSSH Interaction
The flaw concerns how sshd handles password checks when it runs without PAM and calls the system’s crypt() function. The relevant account field and the function’s error value can both be an asterisk, creating the mistaken match. Alpine’s advisory says the machine also needs at least one local account with a $5$ or $6$ password hash because sshd uses that account’s salt during the check.
Alpine’s standard openssh-server package is the best-known affected case. The supplied advisories say Debian, Ubuntu and Red Hat builds are not affected: Ubuntu cites its use of glibc and PAM, while Red Hat says its products are not vulnerable. The source also lists non-Linux systems, glibc-based Linux systems, PAM-based checks, disabled password authentication, and Dropbear as outside the described exposure.
Responsibility for the underlying cause is disputed. OpenSSH said the root cause was outside sshd, although the issue could be exploited through it and avoided there. Musl maintainer Rich Felker argued that the problem was an erroneous use by the caller rather than a musl bug, while saying musl might change the mechanism in an upcoming release cycle. The researcher credited “agent swarms” with finding the flaw; OpenSSH also pointed to AI agents’ ability to rediscover bugs quickly. These statements describe the participants’ views, not a settled attribution of fault.
“An attacker who can reach your SSH port can log in without knowing any password.”
— Alpine Linux security advisory
How Broad Is Exposure?
The exact number of vulnerable or compromised servers is not established in the supplied reporting. GreyNoise’s first successful observation came from one sensor; it does not establish the total scale of attacks. The vulnerability also depends on several conditions being present together, so a Linux server running OpenSSH is not by itself evidence of exposure.
Embedded deployments may need closer review. Medcrypt reported on the oss-security mailing list on November 9 that it reproduced the issue on a stock Yocto image without unusual configuration. The source material does not provide a complete list of affected Yocto, OpenWrt or Buildroot builds, nor does it establish how many deployments are exposed. The disagreement between OpenSSH and the musl maintainer over the root cause also remains unresolved.
Patch, Restart, Check Logs
Administrators should install the fixed OpenSSH release, 10.6p2, where applicable, and restart sshd. Alpine says it published fixed packages across branches from edge back to 3.16. It cautions that installing an updated package alone does not replace a daemon already running in memory. For Alpine systems, administrators should consult the advisory for the fixed package appropriate to their branch.
If patching must wait, disable PasswordAuthentication and check authentication logs for password-based access to accounts whose password field is an asterisk. Teams should verify the full set of conditions—including libc, PAM use, SSH configuration and account records—before concluding a host is affected or unaffected. Further distribution and embedded-platform advisories may clarify which builds require updates.
Key Questions
Does this affect every OpenSSH server?
No. The reported bypass requires a specific combination: Linux with musl, password checks without PAM, password authentication enabled, a target account marked with an asterisk, and a qualifying local password hash. The supplied advisories say Debian, Ubuntu and Red Hat builds are not affected.
What should administrators do first?
Install the fixed OpenSSH package and restart sshd. If an update cannot be applied promptly, disable PasswordAuthentication and review logs for password logins to accounts with no password.
Was the vulnerability used in real attacks?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the patch release. CISA added the flaw to its exploited-vulnerabilities list on November 9. The supplied information does not establish the overall number of attacks or compromised servers.
Are Alpine Linux cloud images affected?
Alpine warned that official tiny-cloud images from versions 3.18.11 through 3.24.3 can become exploitable after a qualifying $6$ hash exists on the machine. Its advisory says the alpine account’s passwordless doas access can make the risk more serious.
Who is responsible for the underlying bug?
That remains disputed. OpenSSH said the root cause was outside sshd but could be avoided there; musl maintainer Rich Felker said the issue was an erroneous use by the caller. The supplied material does not report a settled determination.
Source: ThorstenMeyerAI.com
