TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A flaw tracked as CVE-2026-123158 can allow passwordless SSH login under a specific combination of Linux, musl and sshd settings. OpenSSH released version 10.6p2 on Nov. 5, and CISA added the issue to its exploited vulnerabilities list on Nov. 9. Administrators should update or disable password authentication and review login logs.
The bypass depends on how sshd handles password checks when it is built without PAM and uses musl’s crypt() function. Alpine Linux’s advisory says that, for a password longer than 256 bytes, musl returns * as an error indicator. Some accounts that are not meant to accept password logins have * in the password field. In the affected setup, the error value can match that field and make the check succeed.
The attack requires a particular set of conditions, rather than every OpenSSH server being vulnerable. According to Alpine, the system must run Linux with musl, use sshd without PAM, allow password authentication, have an account with a * password field, and have at least one local account with a $5$ or $6$ password hash. Alpine’s standard OpenSSH server package is a prominent affected configuration. The researcher also identified OpenWrt, Buildroot and Yocto systems as possible environments to check.
OpenSSH 10.6p2 contains the fix. GreyNoise and BleepingComputer reported that exploit code appeared about four hours after the release, and GreyNoise said its sensors recorded a successful break-in about 40 hours after release. These are attributed reports; the source material does not provide a total count of victims. Administrators who cannot update should set PasswordAuthentication no and inspect logs for password logins to accounts that have no password.
Passwordless Logins on Exposed Servers
The flaw matters because a server exposed to network connections on its SSH port could accept a login without the account’s intended password, if all the required configuration conditions are present. That may give an attacker access as a low-privilege user, or provide a route to greater access where that account can elevate privileges. Alpine warns that its tiny-cloud images include an alpine user with passwordless doas in specified releases; those images become exploitable once a qualifying password hash exists.
The reported speed from public exploit code to observed exploitation leaves administrators little time to rely on obscurity. The scope is still limited by the specific software and configuration requirements: Ubuntu says its OpenSSH builds use glibc and PAM and are not affected, while Red Hat says its products are not affected. Debian’s tracker rates the issue unimportant for its packages and lists the fixed upstream version in its unstable branch.
Products Worth Considering
LG UltraGear 27-inch QHD OLED Gaming Monitor, 240Hz
EcoFlow Delta 3 Max Portable Power Station with 220W Solar Panel, 2048Wh
Apple AirPods Pro (2nd Generation) Wireless Earbuds with USB‑C Charging, Up to 2X More Active Noise Cancelling, Transparency Mode, Adaptive
As an affiliate, we earn on qualifying purchases.
How musl’s Error Became a Match
The issue arises from the interaction between OpenSSH’s password-checking path and musl’s handling of an overlong input. In the affected setup, sshd hashes the supplied password and compares the result with the stored password field. Alpine says musl returns * when the input exceeds 256 bytes, while a * field is used for accounts with no password. The same character therefore serves as both an error indicator and a stored value.
Responsibility for the underlying behavior is disputed. OpenSSH said the root cause is outside sshd, though sshd can avoid the vulnerable condition. Musl maintainer Rich Felker argued that the problem is an erroneous use by the caller and said musl may change its mechanism in an upcoming release cycle. OpenSSH’s fix addresses the exploitable path through sshd.
The source material says the bug had been in the code for a decade, citing security writer Bruce Schneier. OpenSSH released the fix Nov. 5, 2026. GreyNoise and BleepingComputer reported public exploit code around four hours later; GreyNoise reported a successful login on one sensor around 40 hours after release. CISA added the vulnerability to its exploited vulnerabilities list on Nov. 9.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password, so the ‘hash’ matches and the login succeeds.””
— Alpine Linux advisory
Embedded Linux Exposure Still Varies
Exposure cannot be determined from the distribution name alone: administrators need to check the actual C library, PAM use, password-authentication setting, account fields and local password hashes. The source material identifies Alpine as the best-known case but does not give a complete inventory of affected devices or deployments.
Embedded Linux remains less settled. Medcrypt reported on the oss-security mailing list on Nov. 9 that it independently reproduced the issue, including on a stock Yocto image. The available material does not establish how widespread that configuration is or which vendors and products ship it. The total number of successful attacks and affected servers is also not stated.
Patch and Review SSH Access
Administrators should install OpenSSH 10.6p2 or a vendor-provided fix, then restart sshd as directed by their system’s update process. If a fix cannot be applied promptly, Alpine’s mitigation guidance is to set PasswordAuthentication no. Teams should also check authentication logs for password logins to accounts whose stored password field is *, and review whether those accounts can elevate privileges.
Operators of Alpine cloud images and embedded systems should compare their package versions and configuration against vendor advisories. Further clarification may come from affected platform maintainers, including musl’s planned mechanism change, but the source material gives no release date for that change.
Key Questions
Which systems are affected by the OpenSSH SSHole bug?
Systems are affected only when the required conditions align: Linux with musl, OpenSSH password checks without PAM, password authentication enabled, an account with a * password field, and a local account with a $5$ or $6$ hash. Alpine’s standard OpenSSH server package is a known example.
Are Debian, Ubuntu and Red Hat systems affected?
The source material says Ubuntu reports its OpenSSH builds are not affected because they use glibc and PAM, and Red Hat says its products are not affected. Debian’s tracker rates the issue unimportant for its packages and lists the fixed upstream version in unstable. Administrators should still follow their distribution’s advisory for their specific package.
What should administrators do now?
Update to OpenSSH 10.6p2 or the vendor’s patched package and restart sshd. If patching is not immediately possible, disable password authentication with PasswordAuthentication no and review authentication logs for password logins to accounts with no password.
Has the flaw been exploited?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the fix was released. CISA added the vulnerability to its exploited vulnerabilities list on Nov. 9, 2026. The material does not state how many systems have been compromised overall.
Source: Thorsten Meyer AI
