🔍 Read the full analysis: Could Your Linux Server Be Affected By The OpenSSH SSHole Bug? on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
OpenSSH fixed CVE-2026-123158, nicknamed “SSHole,” in version 10.6p2, released November 5, 2026. The password-bypass flaw applies only when several conditions coincide, including Linux with musl, password authentication enabled and sshd checking passwords without PAM. Administrators should update and restart sshd, or disable password authentication if they cannot update, then review login logs.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a password-authentication bypass that can affect a limited set of Linux servers. The flaw, nicknamed “SSHole,” may let an attacker who can reach an SSH service log in to certain accounts by submitting an unusually long password, but only when several system and configuration conditions are met.
The issue occurs in a specific combination: Linux using the musl C library, OpenSSH checking passwords without PAM, and password authentication enabled. The affected account must also have an asterisk (*) in its password field, and another local account must have a password hash beginning with $5$ or $6$. Alpine Linux’s standard OpenSSH server package is a prominent example of a potentially affected setup.
Alpine’s advisory explains that musl’s crypt() function returns an asterisk as an error indicator when a password exceeds 256 bytes. In the affected configuration, that result can match the asterisk stored for an account without a password, leading sshd to accept the login. Alpine says an attacker can use a password of 257 to 1,024 bytes; the required conditions still apply.
OpenSSH 10.6p2 contains the fix. GreyNoise and BleepingComputer reported that exploit code became public about four hours after the release, and GreyNoise said its sensor recorded a first successful break-in about 40 hours after release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. Those reports indicate exploitation has been observed, but do not establish how many servers or organizations were affected.
Could Your Linux Server Be Affected?The OpenSSH SSHole bug
A password bypass affects a narrow set of Linux SSH configurations. Check the library and authentication setup, then update and restart sshd.
When the risk applies
The described bypass requires several conditions to coincide.
The affected password-checking behavior involves musl’s crypt() function.
sshd checks passwords without PAM, and password authentication is enabled.
The target account has an asterisk password field, and another local account has a hash starting with $5$ or $6$.
Why the check can fail
An overlong password can trigger an error result that resembles an account’s stored marker.
- An asterisk can mark an account that should not authenticate with a password.
- Alpine’s standard OpenSSH server package is a prominent setup to check.
- musl can return an asterisk for an overlong password as an error indicator.
- In the affected path, sshd may accept a matching login.
Prioritize checks by actual setup
A “Linux server” label alone does not establish exposure.
| Environment or setup | What the material says | Action |
|---|---|---|
| Alpine standard OpenSSH | Potentially affected when required conditions match | Check package and configuration |
| Ubuntu OpenSSH builds | Uses glibc and PAM; reported not vulnerable | Confirm the actual system setup |
| OpenWrt, Buildroot, Yocto | Named as environments to examine; exposure scope is unknown | Check library and sshd settings |
| Non-Linux, Dropbear, containers without sshd | Listed as unaffected | Verify these descriptions apply |
Update, restart and review
A package upgrade may leave the old daemon running until it is restarted.
- Install the fixed package, including OpenSSH 10.6p2 upstream, and restart sshd.
- If you cannot update promptly, disable password authentication and confirm another approved access method works.
- Review authentication logs for suspicious password attempts or successful logins to accounts that should not accept passwords.
- Follow package and security notices from your distribution or embedded-platform maintainer.
Checking Exposure and Fixing SSH Access
The flaw matters because SSH is a common remote-administration route, and a vulnerable server could permit access without a valid password for accounts matching the conditions. If an affected account can gain elevated privileges—for example, through passwordless administrative tools—the potential consequences may extend beyond that account. Alpine specifically warns that a root-login restriction does not prevent an exploitable user from becoming root through another route.
The affected configuration is narrower than the broad description “Linux server” suggests. Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable; Red Hat also says its products are not affected. That distinction can help administrators prioritize checks, but systems assembled for embedded or specialized use may not follow the defaults of major distributions. Knowing the library and sshd configuration is more useful than relying on the operating-system label alone.
For administrators, the immediate choice is to install the corrected package and restart the running daemon, or, if a fix cannot be applied yet, disable password authentication. Reviewing authentication logs can help identify suspicious password logins to accounts that should not accept passwords. A package upgrade alone may leave the old sshd process running, so a restart is part of applying the fix.
Products Worth Considering
Philips Sonicare ProtectiveClean 5300 Rechargeable Electric Toothbrush with 3 Brush Heads, Black
Philips Sonicare 5950 Rechargeable Electric Toothbrush with 2 Brush Heads, Pink
Therabody SmartGoggles 2nd Gen Heated Eye and Temple Massager
As an affiliate, we earn on qualifying purchases.
How the Password Check Failed
Linux account records can use special values in place of password hashes. An asterisk commonly marks an account that should not be able to authenticate with a password. In the affected OpenSSH path, sshd uses the system’s crypt() function to process the submitted password and compare the result with the stored field. The bug arises when musl returns the same asterisk as an error marker for an overlong input.
The responsibility for the underlying failure has been disputed. OpenSSH described the root cause as outside sshd, while saying sshd can avoid the issue. Musl maintainer Rich Felker said he viewed it as an erroneous use by the caller, and said musl may change the mechanism in an upcoming release cycle. The OpenSSH patch addresses the exploitable behavior at the server level.
Alpine lists its standard openssh-server package among the configurations to check, along with certain setups using openssh-server-pam with UsePAM no. Alpine also published fixed packages for branches from edge back to 3.16. Its advisory identifies tiny-cloud images from versions 3.18.11 through 3.24.3 as a particular case to examine: they include an alpine account with an asterisk password field and passwordless doas, and become exploitable once a qualifying $6$ hash exists on the machine.
““An attacker who can reach your SSH port can log in without knowing any password.””
— Alpine Linux security advisory
Which Systems Still Need Checking
The full population of exposed servers is not established. Alpine is the best-known affected case, while the researcher also named OpenWrt, Buildroot and Yocto as environments to examine. A medical-device security firm, Medcrypt, said on the oss-security mailing list on November 9 that it had reproduced the issue, including on a stock Yocto image. That report does not show how widely vulnerable configurations are deployed across those platforms.
Reports of exploitation do not identify the total number of successful attacks or affected organizations. It is also not clear from the available material how many operators have installed the patch or disabled password authentication. Debian’s tracker rates the issue “unimportant” for its packages and lists the fixed upstream version in its unstable branch; administrators should consult the status of their specific package and release rather than infer exposure from that label alone.
Systems using glibc, PAM-based password checks, or disabled password authentication are outside the described vulnerable conditions. Non-Linux systems, Dropbear, and containers that do not run sshd inside are also listed as unaffected. Administrators still need to confirm their actual service, library and configuration rather than assume these exclusions apply.
Update, Restart and Review Logs
Administrators should first establish whether their SSH server uses musl on Linux, whether sshd checks passwords without PAM, and whether password authentication is enabled. If the system is exposed, install a fixed OpenSSH package—upstream version 10.6p2—and restart sshd so the running daemon uses the update. Alpine says its fixed packages cover branches from edge back to 3.16; package names and update commands vary by distribution.
If an update cannot be made promptly, set PasswordAuthentication no and verify that another approved access method is available before relying on SSH for administration. After remediation, inspect authentication logs for password attempts or successful logins to accounts with no password. The source material does not specify a universal log-query method, so administrators should use the logging tools and retention policies for their own systems.
Operators should also watch for package and security notices from their distribution or embedded-platform maintainers. OpenSSH released the correction, Alpine issued package updates, and CISA recorded the issue as exploited; further platform-specific guidance may clarify exposure for systems built with customized libraries or authentication settings.
Key Questions
Can any Linux server be affected by SSHole?
No. The described issue requires a particular combination: Linux with musl, password checking without PAM, password authentication enabled, an account with an asterisk in its password field, and another local account with a $5$ or $6$ hash.
Are Ubuntu and Red Hat systems affected?
Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable. Red Hat says its products are not affected. Check the advisory and configuration for the exact system in use, especially if it has been customized.
What should administrators do first?
Check the OpenSSH package, C library and authentication settings. If the system meets the affected conditions, install the corrected package and restart sshd. If updating is not possible immediately, disable password authentication and review relevant login logs.
Does installing the update automatically protect the running server?
Not necessarily. Alpine warns that upgrading the package alone does not replace the running daemon. Restart sshd after applying the update so the corrected version is active.
Has the flaw been exploited?
GreyNoise said its sensor recorded a successful break-in about 40 hours after the OpenSSH fix was released, and CISA added the flaw to its exploited-vulnerabilities list on November 9. The available reports do not establish the overall number of attacks or affected servers.
Source: ThorstenMeyerAI.com
