🔍 Read the full analysis: Could SSHole Make Your OpenSSH Password A Linux Server Risk? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A flaw tracked as CVE-2026-123158 can allow passwordless SSH access under a narrow set of Linux and OpenSSH conditions, including some Alpine Linux configurations. OpenSSH released version 10.6p2 on November 5, and security monitoring groups reported exploitation soon after; affected administrators should update and restart sshd or disable password authentication.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a flaw that can let an attacker access certain Linux accounts without knowing their passwords. The vulnerability, dubbed SSHole by its finder and rated High at 8.1, affects only specific configurations, including some Alpine Linux servers running OpenSSH with musl and without PAM.
The bypass depends on how OpenSSH handles password checks on systems using the musl C library without PAM, the standard Linux authentication framework. Alpine Linux says musl’s crypt() function returns an asterisk as an error indicator when a submitted password exceeds 256 bytes. On affected systems, that can match the asterisk stored for an account that has no password, causing the check to succeed. The reported attack uses a password between 257 and 1,024 bytes.
The conditions must line up: sshd must run on Linux with musl, password checks must bypass PAM, password authentication must be enabled, an account must have an asterisk in its password field, and another local account must have a $5$ or $6$ password hash. Alpine’s advisory says a single account with a password hash can meet the last condition. The flaw does not mean every Linux server, or every OpenSSH installation, is exposed.
According to the source report, exploit code became public about four hours after the fix was released. GreyNoise reported seeing its first successful break-in on a sensor roughly 40 hours after release. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its list of exploited vulnerabilities on November 9. These reports indicate exploitation activity, but do not establish how many servers have been compromised.
Could SSHole Put Linux Servers at Risk? Check the configuration
SSHole can bypass password checks on a narrow set of Linux and OpenSSH configurations. A fix is available, and exploitation has been reported.
Exposure depends on several conditions
OpenSSH alone does not mean a server is vulnerable; check the host’s actual library and SSH settings.
The reported bypass involves the musl C library.
The affected authentication path does not use PAM.
PasswordAuthentication is enabled, and the required account password fields and hashes are present.
Why the check can fail
On affected systems, an overlong password can trigger an error marker that matches an account’s stored field.
- An asterisk can mark an account that cannot authenticate with a password.
- With musl, an overlong input can return an asterisk as an error indicator.
- The matching characters can make the check succeed.
Who should check
Distribution and build details matter, especially for Alpine and custom or embedded Linux systems.
| Configuration | Reported status |
|---|---|
| Some Alpine Linux systems using musl without PAM | Check required |
| Ubuntu builds using glibc and PAM | Not affected |
| Red Hat products | Not affected |
| Non-Linux, glibc, PAM, disabled password authentication, or Dropbear | Not affected |
Patch and reduce risk
For systems that meet the conditions, act promptly and confirm the daemon is running the fixed version.
Install the fix
Use OpenSSH 10.6p2 or the corresponding fixed package from your distribution.
Restart sshd
Installing a package does not replace a daemon that is already running.
Disable password login
If you cannot patch immediately, set PasswordAuthentication to no and confirm your approved access method still works.
Exposure Depends on Server Configuration
SSH is a common route for administrators to manage Linux servers remotely, so a password bypass can put exposed systems and the accounts they trust at risk. On an affected host, the attacker does not need to guess a valid password for the vulnerable account. The possibility of reaching an account with elevated permissions can increase the consequences: Alpine warns that OpenSSH’s default restriction on direct root password login does not protect a system if another accessible account can become root through a tool such as doas.
The narrow set of requirements matters for triage. Alpine’s standard openssh-server package is a prominent example, while Ubuntu says its builds use glibc and PAM and are not affected. Red Hat also says its products are not affected. Administrators should check the actual system and SSH configuration rather than infer exposure from the presence of OpenSSH alone. In particular, small embedded Linux deployments may use musl-based builds that differ from mainstream distributions.
Reports of public exploit code and observed successful access make timely patching more urgent for systems that meet the conditions. They do not show that all vulnerable servers were attacked, or that a particular organization has been compromised. The reported weakness concerns authentication through sshd, not a general vulnerability in every Linux service or in container software that does not run sshd.
Products Worth Considering
Logitech MX Vertical Wireless Ergonomic Mouse
LG UltraGear 32GX870A-B 32-inch 4K OLED Gaming Monitor
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
How the Password Check Failed
The issue comes from an overlap between two meanings of the same character. In password files, an asterisk can mark an account that cannot authenticate with a password. In the reported musl behavior, the same character can be returned when crypt() encounters an overlong input. When sshd compares the result with the stored field on an affected configuration, the error indicator can look like a successful match.
Responsibility for the underlying behavior is disputed. OpenSSH said the root cause is outside sshd but that the issue is exploitable through sshd and can be avoided there. Musl maintainer Rich Felker argued on the project’s mailing list that the problem was an erroneous use of the library by its caller, while saying musl may change the mechanism in an upcoming release cycle. The OpenSSH update addresses the immediate risk for systems running the fixed version.
Several commonly used configurations are described as not affected: non-Linux systems, Linux systems using glibc, systems that use PAM for the password check, systems with PasswordAuthentication disabled, and systems using Dropbear rather than OpenSSH. Debian rates the issue as unimportant for its packages and lists the fixed upstream version in its unstable branch. Alpine has published fixed packages across supported branches, including some older releases.
“An attacker who can reach your SSH port can log in without knowing any password.”
— Alpine Linux security advisory
Which Systems Still Need Checking
Public information does not establish how many servers remain vulnerable or how many successful attacks have led to lasting compromise. GreyNoise’s sensor observation is evidence of at least one successful attempt in its monitoring environment, not a count of affected organizations. It is also not yet clear how widely the exploit has been used beyond the activity described in the source report.
The status of embedded and custom Linux builds may require individual investigation. A medical-device security firm, Medcrypt, said on the oss-security mailing list that it reproduced the issue, including on a stock Yocto image. That report suggests exposure may extend beyond standard Alpine deployments, but it does not establish that all Yocto-based devices are vulnerable. The relevant library, PAM use, SSH settings, account fields and password hashes need to be checked on each build.
The source material does not provide a complete account of confirmed compromises or say whether all downstream distributions and device vendors have issued packages. Nor does it identify which specific hosts GreyNoise observed. Administrators should treat a system as potentially exposed only after checking whether all required conditions apply, while applying available fixes promptly.
Patch, Restart and Review Logs
Administrators with affected systems should install OpenSSH 10.6p2 or the corresponding fixed package from their distribution, then restart sshd. Alpine specifically warns that installing an updated package does not replace a daemon that is already running. Its advisory provides fixed packages for Alpine branches and directs users to upgrade their installed packages.
If an update cannot be applied immediately, the source report recommends setting PasswordAuthentication no as a temporary measure. That change disables password-based SSH logins, so administrators should confirm that their approved access method will still work before relying on it. After patching or changing configuration, they should review authentication logs for password logins to accounts that have no password and investigate activity they cannot account for.
Operators of embedded systems should check with their vendors and inspect how their OpenSSH build links to the system’s C library and authentication framework. Further distribution advisories and any changes to musl’s error handling may clarify the status of custom builds. Until then, exposure depends on the exact configuration rather than the product name alone.
Key Questions
What is SSHole?
SSHole is the name used for CVE-2026-123158, a flaw that can let an attacker bypass password authentication in certain OpenSSH configurations on Linux systems using musl without PAM.
Are all Linux servers running OpenSSH affected?
No. The source material says the required conditions include Linux with musl, password checks without PAM, password authentication enabled, an account with an asterisk in its password field, and a local account with a $5$ or $6$ password hash. Ubuntu and Red Hat say their products are not affected.
How can administrators reduce the risk?
Install the fixed OpenSSH version or distribution package and restart sshd. If an update is not immediately possible, the source report recommends setting PasswordAuthentication no, then checking logs for password logins to accounts without passwords.
Has exploitation been confirmed?
The source report says GreyNoise observed a successful break-in on one of its sensors about 40 hours after the fix was released, and that CISA added the flaw to its exploited-vulnerabilities list on November 9. Those reports do not establish how many systems were compromised.
Source: ThorstenMeyerAI.com
