🔍 Read the full analysis: OpenSSH SSHole Bug Raises Concerns For Some Linux Servers on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A flaw tracked as CVE-2026-123158 can allow passwordless SSH access on systems meeting several specific conditions, including some Alpine Linux installations. OpenSSH released a fix in version 10.6p2; exploit code appeared publicly soon afterward, and CISA added the vulnerability to its exploited-vulnerabilities list on Nov. 9.
OpenSSH has fixed a high-severity password-checking flaw that can let attackers access certain accounts without knowing their passwords on some Linux servers. The vulnerability, tracked as CVE-2026-123158 and nicknamed “SSHole” by its finder, affects systems using the musl C library when password logins are enabled and SSH checks passwords without PAM. OpenSSH released version 10.6p2 on Nov. 5; the issue matters particularly to administrators of Alpine Linux and some embedded Linux systems.
The vulnerability arises when sshd checks a password without the PAM login framework. On affected systems, an excessively long password can cause musl’s crypt() function to return an asterisk as an error indicator. That matches the stored password field used by some accounts that have no password, so the check can wrongly succeed. Alpine Linux’s advisory says the relevant password length is more than 256 bytes; the source material describes attack inputs between 257 and 1,024 bytes.
The bypass requires several conditions to coincide: Linux with musl, OpenSSH operating without PAM for password checks, password authentication enabled, an account whose password field is an asterisk, and at least one local account with a $5$ or $6$ password hash. Alpine says an attacker who can reach the SSH service can exploit the issue in one connection. These requirements mean the flaw does not affect every OpenSSH server.
OpenSSH released the fix as 10.6p2 on Nov. 5. The source material reports that exploit code became public about four hours later, citing GreyNoise and BleepingComputer, and that GreyNoise recorded a first successful intrusion on one of its sensors about 40 hours after the release. CISA added the vulnerability to its list of exploited vulnerabilities on Nov. 9. Those reports indicate observed exploitation, but do not establish how many systems have been compromised.
SSHole puts some Linux servers at risk Configuration determines exposure
CVE-2026-123158 can allow passwordless SSH access when several local conditions coincide. Administrators should identify matching systems, patch OpenSSH, and review authentication logs.
When systems may be exposed
The bypass requires multiple settings and account conditions to align.
Linux must use the musl C library.
Password logins must be enabled, and sshd must check passwords without PAM.
An account must have an asterisk password field, and the system must have a local $5$ or $6$ password hash.
What the flaw can do
On a matching system, a specially long password can trigger an error response that is mistaken for an account’s asterisk password field.
- An attacker who can reach SSH may access an account without its password.
- One accessible account that can gain elevated privileges may widen the impact.
- Not every OpenSSH or Linux server meets the required conditions.
- Ubuntu says its builds are not vulnerable; Red Hat says its products are not affected.
Reports and remaining uncertainty
Public exploit code reportedly appeared about four hours after the fix. GreyNoise reported a successful attempt on one sensor about 40 hours after release.
Administrator response
Prioritize systems whose library, PAM use, SSH settings, and local accounts match the conditions.
- Install the fixed OpenSSH package and restart sshd; upgrading alone may leave the running daemon unchanged.
- If patching is delayed, disable password authentication.
- Review SSH authentication logs for password logins to accounts with no password, and investigate findings in the context of each system’s configuration.
Why Exposed SSH Servers Are at Risk
SSH is a common way to administer Linux machines remotely. On a server that meets the required conditions, this flaw can turn an account intended for key-only access or otherwise lacking a usable password into a possible entry point. If an accessible account can gain elevated privileges, the impact could extend beyond that account. Alpine warns that its default restriction on direct root login does not protect a vulnerable machine if another accessible account can become root through a tool such as doas.
The reported timing also gives administrators little reason to delay patching: public exploit code followed the fix within hours, and GreyNoise later reported a successful attempt on a sensor. That does not prove a particular server has been targeted, but it makes identifying affected installations and checking for suspicious logins a practical priority. The reported risk is concentrated in particular configurations, so administrators should verify their system’s library, PAM use and SSH settings rather than assume all Linux servers are vulnerable.
Products Worth Considering
FLEXISPOT Adjustable Workbench with Hand Crank, 47.2 x 23.6 Rubberwood Top
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Samsung 34-inch ViewFinity S50GC Ultra-WQHD Monitor
As an affiliate, we earn on qualifying purchases.
Which Linux Configurations Match
Alpine Linux’s standard openssh-server package is the best-known affected case in the source material. Alpine also identifies particular tiny-cloud images, versions 3.18.11 through 3.24.3, that include an alpine account with an asterisk password field and passwordless doas. Alpine says those images become exploitable once a qualifying $6$ password hash exists on the system. Administrators should check the advisory and their exact image and package versions rather than assume that every installation has the same exposure.
Other Linux environments named by the researcher include OpenWrt, Buildroot and Yocto, though the material does not establish that every configuration using those projects is vulnerable. Medcrypt reported on the oss-security mailing list on Nov. 9 that it had reproduced the issue on a stock Yocto image. By contrast, Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable; Red Hat also says its products are not affected. Debian’s tracker rates the issue “unimportant” for its packages and lists upstream fixed version 1:10.6p2-1 in unstable.
OpenSSH attributes the root cause to behavior outside sshd while noting that sshd can avoid the problem. Musl maintainer Rich Felker disputed that the library behavior itself is a bug, describing the failure as an erroneous use by the caller. The source material says musl may change the mechanism in an upcoming release cycle. The disagreement concerns where responsibility lies; the immediate administrative measure is to install the OpenSSH fix or disable password authentication.
“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”
— Alpine Linux advisory
Exposure Depends on Local Settings
The total number of vulnerable or compromised systems is not established in the source material. Exposure depends on several local conditions, including whether sshd uses musl without PAM, whether password authentication is enabled, and which account records and password hashes exist. Reports of exploit code and a successful attempt on a GreyNoise sensor do not identify the number of affected organizations or confirm incidents on other servers.
There is also a difference of opinion over whether the underlying fault belongs to OpenSSH or musl. The source material reports that musl may change its error-return mechanism, but gives no release date or details. Embedded deployments may vary widely, and the Yocto reproduction does not show how broadly the same configuration is used.
Patch, Restart and Review Logs
Administrators should install a fixed OpenSSH package and restart sshd; Alpine cautions that upgrading a package alone does not replace an already running daemon. Alpine says fixed packages are available across branches from edge back to 3.16. Administrators should follow the package instructions for their distribution and confirm the installed version and service status.
If an update cannot be applied immediately, the source material recommends setting PasswordAuthentication no. Administrators should also review SSH authentication logs for password logins to accounts that have no password, and check whether those accounts can gain higher privileges. The available information does not specify a universal log query or establish that a suspicious entry by itself proves exploitation, so findings should be investigated against each system’s configuration.
Key Questions
Which servers are affected by the SSHole vulnerability?
Only systems meeting multiple conditions are affected: Linux with musl, OpenSSH checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and at least one local $5$ or $6$ password hash. Alpine Linux is the best-known example. Ubuntu and Red Hat say their builds or products are not affected.
What should administrators do first?
Install the fixed OpenSSH package for the distribution and restart sshd. If patching is delayed, disable password authentication with PasswordAuthentication no. Then review authentication logs and check affected account privileges.
Does the vulnerability affect all Alpine Linux servers?
No. The advisory describes several conditions that must all apply. Administrators need to check their OpenSSH package, PAM configuration, password-authentication setting, account records and local password hashes to determine exposure.
Has the flaw been exploited?
The source material reports public exploit code roughly four hours after the Nov. 5 fix and a successful intrusion on one GreyNoise sensor about 40 hours after release. CISA added the flaw to its exploited-vulnerabilities list on Nov. 9. These reports do not establish how many other systems were compromised.
Source: ThorstenMeyerAI.com
