🔍 Read the full analysis: OpenSSH SSHole Bug: A Guide To The Overlong-Password Vulnerability on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
OpenSSH released version 10.6p2 on Nov. 5 to fix CVE-2026-123158, a password-check bypass affecting a narrow set of Linux systems using musl without PAM. Public exploit code appeared within hours, GreyNoise reported a successful attack on a sensor, and CISA added the flaw to its exploited-vulnerabilities list. Administrators should update and restart sshd, or disable password authentication if they cannot update.
OpenSSH released version 10.6p2 on Nov. 5 to fix CVE-2026-123158, a flaw that can let an attacker bypass password checks on certain Linux systems and log in to accounts with a disabled-password field. The vulnerability, dubbed SSHole by its finder, affects systems using musl libc when OpenSSH checks passwords without PAM and password login is enabled; public exploit code and a reported successful attack followed the release.
The issue arises when sshd checks a password without the Linux Pluggable Authentication Modules framework, or PAM. In the affected setup, OpenSSH passes the submitted password to the C library function crypt(). Alpine Linux’s advisory says musl returns an asterisk (*) as an error indicator when the input exceeds 256 bytes. Some accounts that are not meant to accept password logins have * in the stored password field. The error value can therefore match that field, causing the check to accept the login.
The advisory says an attacker can use a password between 257 and 1,024 bytes. Exploitation also requires an account with a * password field and at least one local account with a $5$ or $6$ password hash. Alpine identifies its standard openssh-server package as a prominent affected case. The issue is not a general OpenSSH password bypass: the relevant configuration and account conditions must all be present.
OpenSSH’s 10.6p2 release contains the fix. According to the source material, exploit code became public about four hours after the patch, and GreyNoise observed its first successful break-in on a sensor about 40 hours after the release. CISA added the vulnerability to its exploited-vulnerabilities list on Nov. 9. These reports indicate active exploitation, but do not establish how many systems were compromised.
OpenSSH SSHole Bug What administrators need to know
OpenSSH 10.6p2 fixes a password-check bypass with narrow system and account prerequisites. Reports of exploitation make patching and checking the running SSH service time-sensitive.
When the flaw can apply
The reported conditions must align; OpenSSH installations are not all affected.
Linux must use musl libc, and OpenSSH must check passwords without PAM.
Password authentication must be enabled.
An account must have a * password field, and a local account must have a $5$ or $6$ password hash.
How the check can fail
The issue involves how an overlong password is handled in the affected password-checking path.
What reports establish
Exploit activity was reported, but the supplied material does not establish the number of compromised systems.
- Public exploit code appeared about four hours after the patch.
- GreyNoise reported a successful attack on one sensor about 40 hours after release.
- CISA added the flaw to its exploited-vulnerabilities list on Nov. 9.
- The total number of vulnerable systems and confirmed compromises.
- Whether a particular custom build or embedded device meets the prerequisites.
- A Yocto reproduction does not establish that every Yocto-based device is vulnerable.
Act on affected systems
Installing the package alone may leave the vulnerable SSH daemon running.
Install the vendor fix
Use OpenSSH 10.6p2 or the corresponding patched package from your Linux vendor.
Reload the running service
Restart sshd so it uses the corrected code.
Check access and logs
If you cannot update promptly, disable password authentication. Review unexpected password logins and whether affected accounts can gain elevated privileges.
Why SSH Servers Need Prompt Updates
SSH is a common way for administrators and automated systems to access Linux servers remotely. Where the affected conditions apply, the flaw could allow access to accounts whose password field is meant to prevent password login. That creates a risk of unauthorized entry, especially if an affected account can use administrative tools or gain higher privileges.
The reported attack activity makes checking systems time-sensitive, while the narrow prerequisites mean administrators should verify their actual libc, PAM and SSH settings rather than assume every OpenSSH installation is vulnerable. Alpine warns that root’s default SSH restriction does not protect a separate account that can become root through a tool such as doas.
The case also highlights a software-maintenance challenge: the fix must be installed and the running SSH daemon restarted. Alpine says installing the updated package alone does not replace the active daemon. A package update without a service restart may leave the vulnerable process running.
Products Worth Considering
Apple Mac mini Desktop Computer with M6 Chip (2026)
Dell UltraSharp U3225QE 31.5-Inch 4K UHD 120Hz IPS Black Thunderbolt Hub Monitor
Samsung 34-inch ViewFinity S50GC Ultra-WQHD Monitor
As an affiliate, we earn on qualifying purchases.
How the Password Check Failed
The vulnerability is tracked as CVE-2026-123158 and rated 8.1, or High, in the supplied report. Its name, SSHole, comes from the researcher who reported it. The core problem is an interaction between sshd’s password-checking path and musl’s handling of an overlong input, rather than a flaw that applies to all OpenSSH installations.
OpenSSH said the root cause is outside sshd but that sshd can avoid triggering it. Musl maintainer Rich Felker disputed that the behavior is a musl bug, describing it instead as an erroneous use by the caller; he said musl may change the mechanism in an upcoming release cycle. The source also reports that Ubuntu says its OpenSSH uses glibc and PAM and is not affected, while Red Hat says its products are not affected. Debian lists its packages as “unimportant” for this issue and identifies the fixed upstream version in its unstable branch.
Alpine’s advisory lists affected branches and fixed packages, including support for branches back to 3.16. The supplied material also names OpenWrt, Buildroot and Yocto as environments to check. A medical-device security firm, Medcrypt, reported reproducing the issue on a stock Yocto image. That report suggests embedded deployments warrant review, but does not show that every Yocto-based device is vulnerable.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long.”
— Alpine Linux advisory
Which Deployments Still Need Checking
The exact number of vulnerable systems and confirmed compromises is not established in the supplied reports. GreyNoise’s observation was on one sensor; it does not quantify attacks across the internet. Nor does the reported Yocto reproduction establish the status of every embedded product or configuration.
Administrators may also need to determine whether their system meets every prerequisite: Linux with musl, password checking without PAM, password authentication enabled, an account with a * password field, and a local $5$ or $6$ password hash. The source says Debian, Ubuntu and Red Hat builds are not affected, but custom builds and embedded images may differ from distribution defaults. The status of any particular device should be confirmed against its vendor’s advisory and configuration.
Update, Restart and Review Access Logs
Administrators should install the fixed OpenSSH 10.6p2 release or the corresponding patched package supplied by their Linux vendor, then restart sshd so the running service uses the corrected code. Alpine’s instructions include upgrading packages and restarting the daemon; package installation alone is not enough. If an update cannot be applied promptly, the source recommends setting PasswordAuthentication no.
Teams should check SSH logs for unexpected password logins to accounts that normally have no password, and review whether any such account can gain elevated privileges. Embedded-device operators should check with their platform or product vendor, particularly where musl and a non-PAM password path may be in use. Further clarity may come from distribution and vendor advisories, updates to musl, and additional reporting on exploitation.
Key Questions
What is the OpenSSH SSHole vulnerability?
SSHole is the name used for CVE-2026-123158, a flaw in a specific OpenSSH password-checking configuration. On affected systems, an overlong password can produce an error value that matches the stored field for some accounts that should not accept password logins.
Which systems are affected?
The reported conditions require Linux with musl libc, OpenSSH checking passwords without PAM, password authentication enabled, an account whose stored password field is *, and a local $5$ or $6$ password hash. Alpine’s standard openssh-server package is a known example. Check vendor guidance and local settings before deciding whether a system is affected.
Are Ubuntu, Debian and Red Hat affected?
The supplied source says Ubuntu and Red Hat report their builds are not affected; Ubuntu cites glibc and PAM. Debian’s tracker describes the issue as “unimportant” for its packages and lists a fixed upstream version. Custom or embedded builds may differ, so verify the specific system with its vendor.
What should administrators do now?
Install OpenSSH 10.6p2 or the vendor’s patched package, then restart sshd. If an update is not immediately possible, disable password authentication with PasswordAuthentication no, and review logs for unexpected password logins to accounts with disabled-password fields.
Does the reported exploitation show widespread compromise?
No. The source reports public exploit code and a successful attack observed on a GreyNoise sensor, but it gives no total number of affected systems or confirmed compromises. The scope of exploitation remains unclear.
Source: ThorstenMeyerAI.com
