🔍 Read the full analysis: OpenSSH SSHole Bug: How An Overlong Password Can Open Some Linux Servers on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A flaw tracked as CVE-2026-123158 can let an attacker access certain Linux accounts through OpenSSH by sending an overlong password. The issue is limited to specific musl-based systems running OpenSSH without PAM and with password authentication enabled; OpenSSH released a fix as version 10.6p2 on Nov. 5, 2026.
OpenSSH released version 10.6p2 on Nov. 5 to fix a flaw that can let attackers log in to certain Linux accounts using an overlong password instead of a valid credential. Tracked as CVE-2026-123158 and rated High at 8.1, the vulnerability affects a narrow set of systems using the musl C library, with password authentication enabled and OpenSSH checking passwords without PAM.
The bypass occurs when OpenSSH’s server, sshd, checks passwords without the Linux login framework PAM and calls the C library’s crypt() function. Alpine Linux’s advisory says musl returns an asterisk as an error indicator when a password exceeds 256 bytes. That value can match the stored password field for an account that has no password, causing the check to succeed. The reported attack uses a password between 257 and 1,024 bytes.
The advisory lists several conditions that must coincide: Linux with musl, OpenSSH running without PAM, password authentication enabled, an account whose password field is an asterisk, and at least one local account with a $5$ or $6$ password hash. Alpine Linux’s standard openssh-server package is a prominent affected configuration. The source report says Debian, Ubuntu and Red Hat have stated their OpenSSH builds are not affected; Ubuntu cites its use of glibc and PAM.
OpenSSH’s fix is version 10.6p2. Alpine says it published patched packages across supported branches, including older branches, and cautions that installing an update alone does not replace an already running sshd process: administrators must restart the service. If an update is not immediately possible, the source recommends setting PasswordAuthentication no and reviewing logs for password logins to accounts without passwords.
OpenSSH SSHole Bug A password bypass with narrow reach
An overlong password can bypass authentication on some musl-based Linux servers. Exposure depends on several settings lining up, so administrators should check the actual host configuration.
When the bypass can work
The reported attack requires all these conditions on the host.
The host uses the musl C library.
sshd checks passwords without the Linux login framework.
The SSH service accepts password authentication.
An account has an asterisk password field and at least one local account has a $5$ or $6$ hash.
How the check fails
The reported attack uses a password between 257 and 1,024 bytes.
- A password longer than 256 bytes reaches musl’s crypt() function.
- Musl returns an asterisk as an error indicator.
- An asterisk can also appear in the stored field for an account with no password.
- In the affected configuration, the values can match and the check can succeed.
Check the configuration
A platform name alone cannot establish exposure; verify the library, SSH build, settings and account records.
| Configuration | What the source says |
|---|---|
| Alpine standard openssh-server | Prominent affected configuration |
| glibc or PAM-based checks | Outside the described conditions |
| Password authentication disabled | Outside the described conditions |
| Non-Linux, Dropbear, or containers without sshd | Not affected by this flaw |
Patch, restart, review
Administrators should confirm whether every condition applies, including on embedded Linux deployments.
- Install OpenSSH 10.6p2 or the applicable patched distribution package.
- Restart sshd so the running service uses the fix.
- If patching must wait, disable password authentication where feasible.
- Review SSH logs for unusual password logins, especially to accounts with no password set.
A Narrow Bug With Serious Access
The affected configuration is specific, but an exposed SSH service can provide a direct route into a server if all the listed conditions are present. The flaw does not require an attacker to know the account’s password; the reported behavior arises from how an overlong input is handled and compared. That makes identifying the exact operating system, C library and sshd configuration more useful than treating every Linux server as vulnerable.
The timeline described by the source points to a short window for defenders. GreyNoise and BleepingComputer reported that public exploit code appeared about four hours after the fix, and GreyNoise saw a successful login on one of its sensors about 40 hours after release. CISA added the vulnerability to its list of exploited vulnerabilities on Nov. 9. Those reports do not establish how many systems were compromised, but they support prioritizing patching for administrators with potentially affected hosts.
Embedded Linux deployments may need particular attention. The source identifies Alpine, OpenWrt, Buildroot and Yocto as environments where musl may be present, and reports that Medcrypt reproduced the issue on a stock Yocto image. A distribution’s name alone is not enough to determine exposure: the PAM setting, password-authentication setting and account fields also matter.
Products Worth Considering
Samsung Galaxy Tab A9+ 11-Inch Android Tablet, 64GB, Graphite
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
Sony WH-1000XM5 Premium Noise Cancelling Wireless Headphones – Midnight Blue
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
Linux account records can use an asterisk in the password field to indicate that the account cannot authenticate with a password. According to Alpine’s advisory, the problem arises when musl’s crypt() function returns that same asterisk after receiving a key longer than 256 bytes. In the affected OpenSSH configuration, the error value can be mistaken for a matching stored field.
OpenSSH says the root cause is outside sshd, though it can be avoided there. Musl maintainer Rich Felker has argued on the project mailing list that the problem is an erroneous use by the caller rather than a musl bug, while saying musl may change the mechanism in an upcoming release cycle. The source also reports that OpenSSH shipped its fix within a day, with the project citing the speed at which AI agents can rediscover bugs. The vulnerability finder credited “agent swarms” for the discovery.
Not every system that runs OpenSSH is affected. The source says systems using glibc, PAM-based password checks, or disabled password authentication are outside the described conditions, as are non-Linux systems and systems using Dropbear instead of OpenSSH. Containers that do not run sshd inside them are also listed as unaffected. Alpine warns that root’s default OpenSSH restriction may not protect a host if another accessible account can gain root privileges, such as through passwordless doas.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.””
— Alpine Linux advisory
Exposure Depends on Configuration
The number of vulnerable or compromised servers is not established in the source material. GreyNoise’s observation of a successful login on one sensor does not show the scale of exploitation elsewhere. It is also not clear which deployed OpenWrt, Buildroot or Yocto products meet every condition; the reported reproduction on a stock Yocto image is attributed to Medcrypt.
Responsibility for the underlying behavior remains disputed between OpenSSH and the musl maintainer. The source says musl may alter its mechanism in a future release cycle, but gives no release date or final design. Administrators should determine exposure from the actual libc, sshd build, PAM use, authentication settings and account records rather than from a platform label alone.
Patch and Restart SSH Services
Administrators should check whether affected hosts run OpenSSH without PAM on musl-based Linux and whether password authentication is enabled. Where the conditions apply, install OpenSSH 10.6p2 or the distribution’s patched package, then restart sshd so the running service uses the fix. If patching must wait, disable password authentication where operationally feasible.
Afterward, review SSH authentication logs for unusual password logins, especially to accounts that have no password set. The source does not provide a confirmed indicator that can identify every exploitation attempt, so log findings need to be evaluated alongside account and host configuration. Further updates may come from distribution advisories, CISA and the musl project as packages and any library changes are published.
Key Questions
Which systems are affected by CVE-2026-123158?
The source describes affected systems as Linux hosts using musl where OpenSSH checks passwords without PAM, password authentication is enabled, and the required account and password-hash conditions are present. Alpine Linux’s standard openssh-server package is a known example.
Does the flaw affect every OpenSSH server?
No. The reported issue requires several conditions to line up. The source says systems using glibc or PAM-based password checks, systems with password authentication disabled, non-Linux systems and Dropbear are not affected by this flaw.
What should an administrator do?
Install OpenSSH 10.6p2 or the applicable patched distribution package, then restart sshd. If an update cannot be applied promptly, the source recommends disabling password authentication and checking logs for password logins to accounts without passwords.
Has the vulnerability been exploited?
GreyNoise reported seeing a successful login on one of its sensors about 40 hours after the fix was released, and CISA added the flaw to its exploited vulnerabilities list on Nov. 9. The source does not establish the overall number of affected or compromised systems.
Is the bug in OpenSSH or musl?
That remains disputed. OpenSSH says the root cause is outside sshd but can be avoided there; musl maintainer Rich Felker describes the issue as an erroneous use by the caller. OpenSSH’s 10.6p2 release contains the server-side fix described by the source.
Source: ThorstenMeyerAI.com
