🔍 Read the full analysis: How Attackers Use The OpenSSH SSHole Bug Against Some Linux Servers on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A flaw tracked as CVE-2026-123158 allows passwordless access to certain accounts on Linux servers that use OpenSSH with musl, without PAM, and with password logins enabled. Public exploit code appeared about four hours after OpenSSH released a fix on November 5; GreyNoise later recorded a successful intrusion, and CISA added the flaw to its exploited-vulnerabilities list. Affected administrators should update OpenSSH and restart sshd, or disable password authentication if they cannot update.
Attackers have exploited an OpenSSH password-check flaw on at least one monitored system, according to GreyNoise, while the U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its exploited-vulnerabilities list on November 9. Tracked as CVE-2026-123158 and nicknamed “SSHole,” the bug affects a narrow set of Linux servers using musl, OpenSSH without PAM, and password authentication; OpenSSH released a fix on November 5.
The flaw can let a remote attacker reach accounts that have no valid password by submitting an unusually long password. The vulnerable path depends on how OpenSSH’s server, sshd, checks passwords when it is not using PAM, the standard Linux login framework. In affected configurations, musl’s crypt() function returns an asterisk as an error indicator for an overlong password. Some accounts with no password also have an asterisk in their stored password field, allowing the failed check to appear to match.
Alpine Linux’s advisory says the password must be between 257 and 1,024 bytes. It lists additional conditions: the server must run Linux with musl; password checks must bypass PAM; password authentication must be enabled; an account must have an asterisk as its password field; and at least one local account must have a $5$ or $6$ password hash. Alpine says a single account with a real password hash can be enough to make accounts with an asterisk field reachable.
OpenSSH released version 10.6p2 on November 5. GreyNoise and BleepingComputer reported that exploit code became public about four hours later, and GreyNoise said it recorded the first successful break-in on one of its sensors roughly 40 hours after the release. Those timings indicate rapid activity, but the supplied reports do not establish how many systems were compromised.
How Attackers Use the OpenSSH SSHole Bug Against Some Linux Servers
SSHole can bypass password checks on a narrow set of Linux servers. Exploitation has been observed, so administrators should check their configuration, patch, and restart sshd.
Who may be exposed
The listed conditions must align; Linux servers are not all affected.
Linux with musl
The vulnerable password-check behavior depends on musl’s crypt() function.
No PAM, passwords enabled
OpenSSH must check passwords without PAM, with password authentication active.
Asterisk password field
An account with an asterisk in its stored password field may become reachable when a qualifying local password hash exists.
How the check fails
An unusually long password can make an error look like a matching password hash.
The password must be between 257 and 1,024 bytes, according to Alpine’s advisory.
For an overlong password, crypt() returns an asterisk.
If the account’s stored password field is also an asterisk, the failed check can appear to match.
Observed activity, unknown scale
GreyNoise recorded a successful intrusion on one sensor, and CISA listed the flaw as exploited.
- Exploit code became public after the fix.
- A successful attack was recorded on a GreyNoise sensor.
- CISA added SSHole to its exploited-vulnerabilities list.
- How many systems were compromised.
- Which organizations were affected.
- Whether attackers accessed data or maintained access.
Patch and verify
The fix must be running in the SSH service to protect the server.
- Install the corrected OpenSSH package from your distribution.
- Restart sshd; updating the package alone does not replace the running daemon.
- If you cannot update promptly, disable password authentication and confirm the change is active.
- Review logs for password logins to accounts with an asterisk password field and investigate suspicious access.
Risk to Exposed Alpine Servers
The issue matters most to operators of exposed servers that match the full configuration, especially Alpine Linux installations using the standard openssh-server package with password logins enabled. An attacker who can reach the SSH service may be able to access an account without knowing its password. If that account can gain elevated privileges, the consequences could extend beyond the initial login.
Alpine warns that OpenSSH’s usual restriction on direct root password login does not protect a system when another accessible account can become root, for example through passwordless doas. The advisory identifies Alpine’s official tiny-cloud images from versions 3.18.11 through 3.24.3 as a case where the alpine account and doas configuration can create this risk after a qualifying password hash exists. Administrators should assess the actual configuration rather than assume every Alpine server is vulnerable.
The flaw’s reach is limited by its requirements. According to the supplied advisories, the OpenSSH builds from Debian, Ubuntu and Red Hat are not affected by this issue. Those statements do not mean all Linux servers are safe: systems built for embedded use or customized with musl and non-PAM authentication need separate checks.
Products Worth Considering
Logitech MX Vertical Wireless Ergonomic Mouse
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
LG UltraGear 25G590B-B 25-Inch Full HD 1000Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
The bug arises from an interaction between OpenSSH’s password-checking path and the behavior of the C library, rather than from a general weakness in every OpenSSH installation. Alpine’s advisory explains that when a password exceeds musl’s length limit, crypt() returns “*” as an error indicator. For an account whose stored password field is also “*”, the returned error value can be treated as a matching password hash.
OpenSSH says the root cause is outside sshd, but that the issue is exploitable through sshd and can be avoided there. Musl maintainer Rich Felker disputed that characterization, writing on the project’s mailing list that he viewed the problem as “an erroneous use by the caller,” rather than a musl bug. Felker said musl may change the mechanism in an upcoming release cycle. The exchange reflects differing views over where responsibility lies, while the OpenSSH fix provides an immediate mitigation for users.
Alpine is the best-known affected case in the source material. The researcher also named OpenWrt, Buildroot and Yocto as environments to check, though those platforms are not automatically vulnerable: the listed configuration conditions still apply. Ubuntu says its OpenSSH is linked against glibc and uses PAM; Red Hat says its products are not affected. Debian’s tracker rates the issue “unimportant” for its packages and lists upstream fixed version 1:10.6p2-1 in its unstable branch.
“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”
— Alpine Linux advisory
Extent of Attacks Still Unknown
GreyNoise’s report of a successful intrusion on one sensor and CISA’s listing establish that exploitation has been observed, but the supplied material does not say how many victims there are, which organizations were affected, or whether attackers accessed data or maintained access. The listing also does not provide a count of vulnerable servers. The reports describe a narrow set of conditions, so exposure depends on local library, PAM, account and SSH settings.
Coverage across embedded systems remains less clear. Medcrypt reported on the oss-security mailing list on November 9 that it had independently reproduced the issue, including on a stock Yocto image without unusual configuration. That report suggests some deployments warrant investigation, but it does not establish that all Yocto devices—or all systems built with OpenWrt or Buildroot—are affected. The dispute over whether the underlying fault belongs to OpenSSH or musl also remains unresolved in the cited statements.
Patch and Verify SSH Services
Administrators should install the corrected OpenSSH release available for their distribution and restart sshd so the running service uses the patched code. Alpine says fixed packages were published across its branches, including older releases, and specifically warns that installing an update without replacing the running daemon is not enough. Package names and version numbers can differ by distribution, so operators should check their vendor’s security notice.
If an update cannot be applied promptly, the source recommends setting PasswordAuthentication no and confirming the change is active. Administrators should also review authentication logs for password logins to accounts whose stored password field is an asterisk, then investigate any suspicious access. Systems with SSH exposed to the internet should be prioritized for configuration review and patching.
Further guidance may come from distribution advisories, OpenSSH and musl maintenance, and security monitoring as organizations assess embedded deployments. Until that work clarifies the scope, administrators should treat the specific combinations identified by Alpine as the test for exposure, rather than applying the vulnerability label to all Linux servers.
Key Questions
What is the OpenSSH SSHole vulnerability?
CVE-2026-123158 is a password-checking flaw that can allow access to certain accounts without a valid password when OpenSSH runs in a specific Linux and musl configuration.
Which servers are affected?
A server must meet several conditions: Linux with musl, OpenSSH checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and at least one local account with a $5$ or $6$ password hash. Alpine is a prominent example, but the configuration—not the distribution name alone—determines exposure.
Are Ubuntu, Debian and Red Hat systems affected?
The cited advisories say the relevant OpenSSH builds from Ubuntu and Red Hat are not affected; Debian’s tracker rates the issue unimportant for its packages. Customized installations should still be checked against the stated technical conditions.
How should administrators respond?
Install the fixed OpenSSH package, then restart sshd. If patching must wait, disable password authentication with PasswordAuthentication no, and review logs for unexpected password logins to accounts with an asterisk password field.
Has the number of victims been reported?
No victim total is provided in the source material. GreyNoise reported a successful intrusion on one sensor, but the broader number of affected or compromised systems remains unclear.
Source: ThorstenMeyerAI.com
