Read the full analysis: OpenSSH SSHole: How The Password Bug Could Affect Linux Servers on ThorstenMeyerAI.com
TL;DR
A flaw tracked as CVE-2026-123158 can let an attacker log in without a valid password to certain Linux servers running OpenSSH with musl and specific password settings. OpenSSH released a fix on Nov. 5, 2026; administrators should update and restart sshd, or disable password authentication if they cannot update. Major distributions including Ubuntu and Red Hat say their builds are not affected.
OpenSSH has fixed a password-authentication bypass that could let attackers log in to some Linux servers without knowing an account password, but the flaw affects only systems meeting several specific conditions. The issue, tracked as CVE-2026-123158 and nicknamed “SSHole” by its finder, was patched in OpenSSH 10.6p2 on Nov. 5, 2026; administrators of potentially affected servers should update and restart the SSH service.
The bug involves OpenSSH’s handling of password checks when its server, sshd, runs on Linux with the musl C library and checks passwords without PAM, a standard Linux login framework. According to Alpine Linux’s advisory, musl’s crypt() function returns an asterisk when a password input exceeds 256 bytes. Some accounts that are not meant to accept password logins also have an asterisk in their stored password field. In the affected configuration, those values can match and sshd may accept the login.
The source report says an attacker can trigger the behavior with an unusually long password, between 257 and 1,024 bytes. Alpine says the system also needs at least one local account with a password hash beginning with $5$ or $6$, alongside an account whose password field is an asterisk. The other requirements are that sshd uses musl, password checks bypass PAM, and PasswordAuthentication is enabled. The presence of only some of these conditions is not enough to establish that a server is vulnerable.
OpenSSH 10.6p2 contains the fix. The source report says exploit code became public about four hours after the release, citing GreyNoise and BleepingComputer, and GreyNoise recorded a first successful break-in on one of its sensors about 40 hours after the fix was released. CISA added the vulnerability to its list of exploited vulnerabilities on Nov. 9. Those reports indicate observed exploitation, but do not establish how many servers were compromised.
OpenSSH SSHole Who may be affected?
A password-authentication flaw can affect a narrow set of Linux servers. Exposure depends on several specific system and account settings.
Exposure requires a specific setup
A Linux server is at risk only when the relevant library, authentication path, account records and SSH settings align.
sshd runs with musl and checks passwords without PAM.
The system has an asterisk password field and a local password hash beginning with $5$ or $6$.
PasswordAuthentication is enabled.
Why the check can fail
In the affected configuration, an overlong password can make musl’s crypt() return an asterisk that matches an account’s stored asterisk field.
Linux with muslPassword checks bypass PAMPassword authentication enabled
Systems using glibcSystems using PAM for password checksNon-Linux systems, Dropbear and containers without sshd
Check custom and embedded builds
Alpine, OpenWrt, Buildroot and Yocto deployments may warrant review; their names alone do not establish exposure.
Review image changes
Alpine identifies certain tiny-cloud images as a case to check; they can become exploitable once a qualifying $6$ hash exists.
Verify the actual system
Check the installed library, PAM use, SSH package, password settings and account records.
Reduce risk and verify
Use the relevant vendor advisory and confirm the running service uses the fixed package.
Install OpenSSH 10.6p2 or the vendor’s fixed package.Restart sshd after updating.If you cannot update promptly, disable password authentication when appropriate.Review logs; reported exploitation does not establish how many servers were compromised.
Exposure Depends on Server Configuration
The flaw matters most to administrators running Alpine Linux or custom embedded Linux builds that satisfy all the listed conditions. Affected servers could allow access to accounts intended to have no usable password, which may give an intruder a foothold. The risk can be greater where an affected user can obtain elevated privileges: Alpine warns that its default root-login restriction does not prevent escalation through another account with tools such as doas.
Alpine’s advisory identifies its official tiny-cloud images from versions 3.18.11 through 3.24.3 as a particular case. They include an alpine account with an asterisk password field and passwordless doas, according to the advisory. Alpine says the images are safe on first boot but can become exploitable once a qualifying $6$ password hash exists on the system. That caveat makes configuration and changes made after deployment relevant to an assessment.
For administrators, the immediate issue is not whether a server runs Linux generally, but whether its library, authentication path, account records and SSH settings line up with the affected conditions. The reported exploitation and public availability of exploit code support treating the patch as urgent on systems that match them, while avoiding the assumption that every OpenSSH server is exposed.
How the Password Check Fails
The issue sits at the boundary between sshd and the system’s C library. OpenSSH’s account of the bug says the root cause is outside sshd, though the behavior can be triggered through sshd and avoided there. Musl maintainer Rich Felker, in a mailing-list post, characterized the problem differently: he said it was “not a bug in musl” but an erroneous use by the caller, and said musl may change the mechanism in a future release cycle. The disagreement concerns where responsibility lies, not whether the reported configuration can be vulnerable.
The affected scope is narrower than the name “Linux server” might suggest. The source report says systems using glibc, systems that use PAM for password checks, non-Linux systems, and servers with password authentication disabled are not affected by this issue. It also lists Dropbear and containers that do not run sshd internally as outside the described scope. Ubuntu says its OpenSSH is linked against glibc and uses PAM; Red Hat says its products are not affected. Debian’s tracker labels the issue “unimportant” for its packages and lists upstream-fixed version 1:10.6p2-1 in its unstable branch.
Alpine’s advisory lists fixed packages for its supported branches, including older branches, and recommends updating. The source report also describes the vulnerability as a result of security research using “agent swarms,” while OpenSSH said it shipped a fix within a day because AI agents can rediscover bugs quickly. Those statements describe the participants’ views of the research and response; they do not change which system configurations are affected.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password, so the ‘hash’ matches and the login succeeds.””
— Alpine Linux advisory
Embedded Builds Need Checking
It is not clear from the available information how many systems are vulnerable or have been compromised. The reported sensor observation and CISA listing establish that exploitation was reported, but do not quantify attacks across the internet or confirm the status of individual machines. Operators need to check their own packages and configurations against the advisory rather than infer exposure from the operating system name alone.
Some embedded and custom Linux deployments may need closer review. The source report names OpenWrt, Buildroot and Yocto as environments that can use musl, and says Medcrypt reported reproducing the issue on a stock Yocto image. That report does not establish that every device built with those projects is vulnerable. The installed C library, PAM use, SSH package, password settings and account records determine whether the conditions are met.
Responsibility for the underlying behavior also remains disputed between OpenSSH and musl’s maintainer. The source says musl may alter its mechanism in a future release cycle, but gives no release date or details of a change. That uncertainty does not remove the need to apply OpenSSH’s available fix on affected systems.
Patch, Restart, Then Review Logs
Administrators should install a fixed OpenSSH package and restart sshd, because upgrading the package alone may leave the old daemon running. Alpine’s advisory lists fixed packages for its branches and gives “apk upgrade -U -a” as an update command. Package names and procedures vary by distribution, so operators should follow the relevant vendor advisory and verify that the running service uses the patched version.
If an update cannot be applied promptly, the source report recommends setting PasswordAuthentication no, provided that doing so fits the server’s access requirements. Administrators should also review authentication logs for password logins to accounts that have no password, as recommended in the source material, and investigate suspicious access. The report does not provide a universal log signature or a confirmed list of compromised hosts, so log review should be combined with each system’s normal incident-response process.
Operators of embedded images and custom builds should confirm whether sshd is linked against musl, whether PAM is in use, and whether password authentication and the relevant account states are present. Future advisories from OpenSSH, Alpine, musl and the affected platform vendors may clarify fixes for downstream builds. Until then, the confirmed OpenSSH patch and configuration checks are the practical next steps.
Key Questions
Which Linux servers can be affected by SSHole?
Servers may be affected when they run OpenSSH on Linux with musl, check passwords without PAM, have password authentication enabled, and contain both an account with an asterisk password field and a local account with a $5$ or $6$ password hash. All listed conditions matter.
Are Ubuntu and Red Hat systems affected?
Ubuntu says its OpenSSH builds use glibc and PAM and are not affected. Red Hat says its products are not affected. Administrators should still consult their distribution’s current security advisory for the exact package and system status.
What should administrators do first?
Install a fixed OpenSSH package and restart sshd. If a patch cannot be applied promptly, the source report recommends disabling password authentication where operationally appropriate and reviewing logs for suspicious password access to accounts without passwords.
Does using Alpine Linux automatically mean a server is vulnerable?
No. The advisory describes several requirements, including the authentication method, password-login setting, account fields and presence of a particular password hash. Alpine administrators should check their configuration and install the fixed package rather than assume exposure based on the distribution alone.
Has exploitation been confirmed?
The source report says GreyNoise observed a successful break-in on one sensor about 40 hours after OpenSSH released the fix, and that CISA added the flaw to its exploited-vulnerabilities list on Nov. 9, 2026. Those reports do not say how many systems were affected or compromised.
Source: ThorstenMeyerAI.com