🔍 Read the full analysis: The Link Between Overlong SSH Passwords And The OpenSSH SSHole Bug on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
OpenSSH fixed CVE-2026-123158, dubbed SSHole, on November 5, 2026. The flaw can let an attacker log in without a valid password on systems meeting several specific conditions, including Linux with musl, password authentication enabled and no PAM check. Exploit code appeared within hours, and CISA added the flaw to its exploited-vulnerabilities list on November 9.
OpenSSH released a fix on November 5 for a flaw that can let attackers access certain Linux accounts without knowing their passwords, using an overlong password string. Tracked as CVE-2026-123158 and nicknamed “SSHole,” the vulnerability affects a narrow set of systems running OpenSSH with the musl C library and password checks outside PAM, but public exploit code and a reported successful attack followed the fix within days.
The issue arises when OpenSSH checks a password without PAM and uses the C library function crypt() to compare it with an account’s stored password field. Alpine Linux’s advisory says musl returns an asterisk (*) as an error indicator when the supplied password exceeds 256 bytes. Accounts configured with an asterisk in place of a password hash can therefore produce a matching value, allowing the authentication check to pass. The source describes exploit inputs of 257 to 1,024 bytes.
Alpine says the bypass requires several conditions at once: OpenSSH must run on Linux with musl; password checks must happen without PAM; password authentication must be enabled; an account must have a “*” password field; and another local account must have a $5$ or $6$ password hash. The asterisk field is used for accounts that should not authenticate with a password. Alpine identifies its standard openssh-server package as a known affected setup.
OpenSSH’s fix is version 10.6p2. The supplied reporting says exploit code became public about four hours after the release, citing GreyNoise and BleepingComputer, and GreyNoise recorded a first successful break-in on one of its sensors about 40 hours after release. CISA added the flaw to its exploited-vulnerabilities list on November 9, according to the source material.
The OpenSSH SSHole bug and overlong passwords
CVE-2026-123158 can bypass password authentication on a narrow set of Linux systems. Exposure depends on the library, authentication setup and local account fields.
How the bypass works
On affected setups, an overlong password can make musl return an error marker that matches an account’s stored password field.
The supplied password exceeds musl’s 256-byte limit.
musl’s crypt() returns an asterisk as the error indicator.
An account with an asterisk in its password field may pass the comparison.
Exposure depends on configuration
The reported conditions must align; OpenSSH alone does not make a host vulnerable.
| Check | Reported requirement |
|---|---|
| Platform and library | Linux with musl |
| Password checks | Without PAM, with password authentication enabled |
| Account state | An asterisk password field and another local account with a $5$ or $6$ hash |
Who needs to check?
Alpine’s standard openssh-server package is a known affected setup.
- Qualifying Linux systems using musl
- Alpine official tiny-cloud images in versions 3.18.11 through 3.24.3, once a qualifying hash exists
- A stock Yocto image reproduced by Medcrypt
- Linux systems using glibc
- Setups using PAM for password checks
- Systems with PasswordAuthentication disabled
- Non-Linux systems, Dropbear and containers without sshd
Reduce risk and verify
Install the fixed OpenSSH package and restart the running daemon.
- Check the system’s C library, PAM use and password-authentication setting.
- Review account fields and required local password hashes.
- If an update cannot be applied immediately, set PasswordAuthentication no.
- Review authentication logs for password logins to accounts with an asterisk field.
Why Musl-Based Servers Need Attention
The conditions are specific, but systems that meet them may face a password-authentication bypass, not merely a weakness that makes password guessing easier. The source reports that the attack can succeed with a single connection, so affected administrators should treat exposure as an access-control issue and apply the fix promptly.
Alpine’s official tiny-cloud images from versions 3.18.11 through 3.24.3 are singled out in its advisory: they include an alpine user with an asterisk password field and passwordless doas. The advisory says those images become exploitable once a qualifying $6$ password hash exists on the machine. OpenSSH’s usual root-login setting does not necessarily remove risk if another accessible account can gain root privileges.
The reports of public exploit code and observed exploitation add urgency, but they do not establish that every OpenSSH host is vulnerable. Ubuntu says its build uses glibc and PAM and is not affected; Red Hat also says its products are unaffected. Administrators need to check the actual library, authentication configuration and account state rather than infer exposure from the presence of OpenSSH alone.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
DJI Mini 4 Pro Fly More Combo with DJI RC 2
LG UltraGear 32-inch Curved QHD Gaming Monitor (2560×1440, 180Hz, 1ms, 1000R, HDR10)
As an affiliate, we earn on qualifying purchases.
How the Asterisk Match Occurs
On affected configurations, OpenSSH asks musl’s crypt() to process the supplied password and compares the result with the stored account field. Alpine’s explanation is that an overlong input produces “*” as an error indicator, while a locked or passwordless account may also have “*” stored. That overlap can turn a failed password calculation into an apparent match.
The flaw has prompted disagreement over where responsibility lies. OpenSSH says the root cause is outside sshd, though the issue is exploitable through it and can be avoided there. Musl maintainer Rich Felker argued on the musl mailing list that the problem is an erroneous use by the caller, while saying musl may change the mechanism in an upcoming release cycle.
According to the source material, non-Linux systems, Linux systems using glibc, setups that use PAM for password checks, and systems with PasswordAuthentication no are not affected by this issue. Dropbear and containers that do not run sshd inside are also listed as unaffected. The report says accounts with “!” rather than “*” in the relevant field cannot log in through this bypass.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.”
— Alpine Linux advisory
Exposure Depends on Local Configuration
The available reporting does not establish how many systems are exposed or how widespread exploitation has become. The GreyNoise observation concerns one sensor; it is not a count of affected victims. Exposure depends on all listed software and account conditions being present, and the source notes less certainty about some embedded Linux environments.
Medcrypt reported on the oss-security mailing list on November 9 that it reproduced the issue on a stock Yocto image without unusual configuration. That report points to possible exposure beyond Alpine, but the supplied material does not provide a full inventory of affected Yocto builds or other embedded products. The dispute over whether the root cause belongs to OpenSSH or musl also remains unresolved in the cited statements.
Patch, Restart and Review Logs
Administrators should install a fixed OpenSSH package and restart sshd. Alpine says its fixed packages cover branches from edge back to 3.16, including releases no longer receiving regular updates. It warns that installing a package alone does not replace the running daemon. Where an update cannot be applied immediately, the source recommends setting PasswordAuthentication no.
After mitigation, administrators should review authentication logs for password logins to accounts whose stored password field is “*”. They should also check whether the host uses musl, whether PAM is involved in password checks, whether password authentication is enabled, and whether the required account hashes are present. Further clarity may come from distribution advisories, updates to musl, and additional reporting on embedded systems and exploitation.
Key Questions
What is the OpenSSH SSHole bug?
CVE-2026-123158 is a password-authentication bypass in certain OpenSSH setups. On affected systems, an overlong password can trigger a musl error value that matches the stored “*” field of an account that should not accept password logins.
Which systems are affected?
The reported conditions include Linux with musl, OpenSSH password checks without PAM, password authentication enabled, an account with a “*” password field, and another local account with a $5$ or $6$ hash. Alpine’s standard openssh-server package is a known example; check distribution guidance and local configuration.
Are Ubuntu, Debian and Red Hat systems affected?
The source says Ubuntu reports its OpenSSH uses glibc and PAM and is not vulnerable, and Red Hat says its products are not affected. Debian’s tracker rates the issue “unimportant” for its packages and lists the fixed upstream version in its unstable branch. Administrators should consult current vendor advisories for their exact release.
How should administrators respond?
Upgrade to a fixed OpenSSH package—10.6p2 upstream—and restart sshd. If an update is not yet possible, disable password authentication and inspect logs for password logins to accounts with a “*” password field.
Does public exploit code mean my server was compromised?
No. Public exploit code raises risk but does not show that a particular server was attacked. The source reports a successful event on one GreyNoise sensor; administrators should check their own logs and systems for evidence of access.
Source: ThorstenMeyerAI.com
