🔍 Read the full analysis: What’s Behind The OpenSSH SSHole Bug Affecting Some Linux Servers? on ThorstenMeyerAI.com
TL;DR
OpenSSH fixed CVE-2026-123158, nicknamed SSHole, on November 5, 2026. The password-authentication bypass affects a narrow set of Linux systems using musl without PAM, but public exploit code and a recorded successful intrusion followed the patch. Administrators should update OpenSSH and restart sshd, or disable password authentication until they can update.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a password-authentication bypass affecting some Linux servers that use the musl C library without PAM. Attackers can exploit the flaw with an unusually long password, but only when several account and server settings align; reports cited by ThorstenMeyerAI.com say public exploit code appeared within hours and a successful intrusion was recorded roughly 40 hours after the release.
The flaw, rated 8.1 (“High”) and nicknamed “SSHole” by its finder, involves how OpenSSH’s server, sshd, handles password checks on affected systems. According to Alpine Linux’s advisory, musl’s crypt() function returns an asterisk when the supplied password exceeds 256 bytes. Some accounts that should not accept password logins also have an asterisk in their password field. Under the vulnerable conditions, those values can appear to match, allowing authentication to succeed.
The attack requires a password between 257 and 1,024 bytes, according to the source report. Alpine says a reachable SSH service can be enough for an attacker to attempt the bypass. The advisory also identifies another prerequisite: the system must have at least one local account with a $5$ or $6$ password hash, which sshd uses to obtain a salt during the check.
Systems are affected only when all relevant conditions are present: Linux with musl, sshd checking passwords without PAM, password authentication enabled, an account whose stored password field is an asterisk, and an account with one of those password hashes. Alpine’s standard OpenSSH server package is a known example. The source material names OpenWrt, Buildroot and Yocto as other environments to check, but does not establish that every installation of those systems is vulnerable.
What’s behind the SSHole bug?
CVE-2026-123158 can bypass password authentication on Linux servers with a specific combination of musl and account settings. Check the actual build and configuration, then patch and restart sshd.
When the bypass can work
Every relevant condition must align on the server.
The vulnerable password check depends on musl’s handling of overlong passwords.
Password authentication must be enabled, and at least one local account must have an asterisk in its password field.
At least one local account must use a $5$ or $6$ password hash. The attack uses a password between 257 and 1,024 bytes.
Why the check can fail open
On affected configurations, an error value can be mistaken for a valid password match.
- An asterisk in the stored password field prevents password login.
- An overlong password should fail its hash check.
- For input over 256 bytes, musl’s crypt() returns an asterisk.
- Without PAM, sshd may mistake that value for a match with the stored asterisk.
Check the exact system
A platform name alone does not establish exposure.
Embedded builds
Check OpenWrt, Buildroot and Yocto deployments individually. A stock Yocto image was reported to reproduce the flaw, but not every build is affected.
Common unaffected setups
The source says glibc-based Linux, PAM-based checks, disabled password authentication, non-Linux systems and Dropbear are not affected by this issue.
What administrators should do
- Install the fixed OpenSSH package for your distribution.
- Restart sshd; updating the package alone leaves a running daemon in place.
- If you cannot update immediately, set PasswordAuthentication no temporarily.
- Review authentication logs for suspicious password logins to accounts with no password set.
- Verify the running daemon uses fixed code and check the relevant account settings.
Why SSH Password Checks Matter
SSH is a common way for administrators to access servers remotely, so a bypass can put systems at risk without an attacker knowing a legitimate user’s password. The impact depends on the affected server’s configuration and on which accounts can be reached; the flaw does not make every Linux server vulnerable. If a compromised account can gain elevated privileges—for example, through a passwordless privilege-escalation tool—the consequences could extend beyond that account.
The reported pace of activity adds urgency for administrators of potentially affected systems. GreyNoise and BleepingComputer are cited as reporting that exploit code became public about four hours after the patch, while GreyNoise observed a successful intrusion on one of its sensors about 40 hours after release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9, according to the source. These reports do not establish how many servers were exposed or how many were compromised.
The case also highlights a practical challenge for smaller and embedded Linux deployments: a distribution’s name alone may not reveal whether its exact build uses musl, PAM, or the affected password settings. Administrators need to check the actual software and configuration rather than assume that a system is safe because a major distribution is unaffected.
Popular right now
Ninja PB051 Single-Serve Coffee Maker for Pods and Grounds
Ninja Crispi 4-in-1 Portable Glass Air Fryer, Grey, FN101GY
LG 55-Inch QNED73B Mini LED 4K Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
How the Musl Error Became a Bypass
Ordinarily, an asterisk in an account’s password field represents a password that cannot be used for login. The flaw arises when sshd checks passwords without PAM and calls the C library’s password-hashing function. Alpine’s explanation is that, for an overlong input, musl returns an asterisk as an error indicator. Because that is also the stored field for some accounts, the failed hash operation can be mistaken for a valid match.
Responsibility for the underlying issue is disputed. OpenSSH says the root cause is outside sshd, though it can be exploited through sshd and avoided there. Musl maintainer Rich Felker wrote on the musl mailing list that, in his view, the issue is “not a bug in musl” but an erroneous use by the caller; he said musl may change the mechanism in an upcoming release cycle. Those positions describe a disagreement about where the defect belongs, not a dispute that the OpenSSH patch addresses the exposed path.
The reported scope excludes several common setups. Ubuntu says its OpenSSH packages use glibc and PAM and are not vulnerable; Red Hat also says its products are unaffected. Debian’s tracker rates the issue “unimportant” for its packages and lists the fixed upstream version in its unstable branch. The source says non-Linux systems, glibc-based Linux systems, PAM-based password checks, disabled password authentication, and systems using Dropbear are not affected by this specific issue.
„“It is my position that this is not a bug in musl just an erroneous use by the caller.”“
— Rich Felker, musl maintainer, on the musl mailing list
Which Builds Still Need Checking
The source material does not identify the total number of exposed servers or provide a confirmed count of compromises. It also does not establish that every OpenWrt, Buildroot or Yocto deployment is affected; exposure depends on the library, PAM use, password-authentication setting and account state on each system.
Embedded deployments may need particular scrutiny. Medcrypt reported on the oss-security mailing list on November 9 that it independently reproduced the flaw, including on a stock Yocto image. That report signals that some embedded builds may meet the conditions, but it does not determine the status of all products built with Yocto or other embedded frameworks. The precise relationship between musl and sshd remains a matter of disagreement between the OpenSSH project and musl’s maintainer.
Patch, Restart and Review Logs
Administrators should install a fixed OpenSSH package and restart sshd; Alpine warns that upgrading the package alone does not replace an already running daemon. OpenSSH 10.6p2 is the upstream fix. Alpine says it has published fixed packages for supported branches and backported fixes to older branches, but administrators should check the package version and instructions for their own distribution rather than assume the upstream version number applies unchanged.
If an immediate update is not possible, the source recommends setting PasswordAuthentication no as a temporary mitigation. Administrators should also review authentication logs for suspicious password logins to accounts that have no password set, while recognizing that logs alone may not settle whether a system was compromised.
After patching, operators of musl-based or embedded systems should verify whether sshd runs without PAM, whether password authentication is enabled, and whether relevant accounts have an asterisk in their password field. The next practical milestone is confirmation that the running daemon—not just the installed package—uses the fixed code. The source does not give a single completion date for that work across affected distributions.
Key Questions
What is the OpenSSH SSHole vulnerability?
SSHole is CVE-2026-123158, a password-authentication bypass in certain OpenSSH server configurations. On affected systems, an overlong password can trigger a musl error value that may match an asterisk stored for an account that should not accept password login.
Which Linux servers are affected?
Only systems meeting several conditions are affected: Linux with musl, sshd checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and a local account with a $5$ or $6$ hash. Check the specific build and configuration; a distribution or project name alone is not enough to determine exposure.
Are Ubuntu, Debian and Red Hat affected?
The source reports that Ubuntu says its OpenSSH build uses glibc and PAM and is not vulnerable, while Red Hat says its products are unaffected. Debian’s tracker rates the issue “unimportant” for its packages and lists a fixed upstream version in its unstable branch.
How should administrators respond?
Install the fixed OpenSSH package for the system and restart sshd. If patching must wait, disable password authentication with PasswordAuthentication no and review authentication logs for suspicious logins to accounts that have no password set.
Source: ThorstenMeyerAI.com
