Vulnerability · critical
OpenSSH authentication flaw on musl/Alpine systems without PAM, with 10.6p2 workaround
Tier A · Patch today – Before you go home
Who’s exposed: Alpine and musl systems running openssh-server without PAM
Tier A because: Core infrastructure or popular tool AND remote, no login AND full takeover
Reach
Attack
Damage
Fix
Core infrastructure · Popular tool · Remote, no login · Full takeover
The Brief
- OpenSSH 10.6p2 was released with a workaround for a critical flaw affecting Linux systems that use musl libc with PAM disabled, such as Alpine Linux.
- Dubbed "*sshole", the flaw lets attackers log into accounts configured to block password authentication by sending an oversized password.
- Attackers need network access to the SSH server, an account name, and a password between 257 and 1,024 bytes long.
Why it matters
Servers on affected musl systems without PAM can be accessed through accounts that were meant to be key-only, so exposed SSH servers and Alpine-based containers need updating or hardening now.
The checklist behind the tier
Checklist · 5 of 10 yes
| Yes | Hits tech teams | Judgment: OpenSSH servers on Alpine are run by ops and IT teams, so this affects systems they operate. |
| Yes | Core infrastructure | Judgment: OpenSSH is core infrastructure that nearly every team runs for remote access. |
| Yes | Popular tool | Judgment: OpenSSH is a widely used, mainstream server package. |
| No | Exploited in the wild | No source reports observed attacks using this flaw; sources only describe that it allows login. |
| No | Public exploit | No source says exploit code or a step-by-step PoC is published; details are not described as public. |
| Yes | Remote, no login | The Hacker News: attackers need only network access, an account name, and an oversized password, no valid credentials. |
| Yes | Full takeover | Ars Technica: the vulnerability lets hackers log into devices with no password, an authentication bypass. |
| No | Secrets exposed | No source reports stolen credentials, keys, configs, source code or customer data. |
| No | Supply chain | No source reports compromised packages, updates, build pipelines or signing keys; it is a normal bug. |
| No | No fix yet | The Hacker News: OpenSSH issues emergency fix; LWN: version 10.6p2 released with a workaround. |
Timeline
Alpine Linux security advisory published
OpenSSH 10.6p2 released with workaround for the musl/PAM flaw
Hacker News: Front Page
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability
Hacker News
170 points · 81 comments
LWN.net
Critical security vulnerability affects OpenSSH on Alpine Linux systems
Hacker News: Front Page
OpenSSH 10.6p2 Critical workaround for alpine without PAM
Hacker News
131 points · 7 comments
Hacker News: Front Page
Alpine Linux Security advisory: OpenSSH-server password authentication bypass
Hacker News
539 points · 105 comments
The Hacker News
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
BleepingComputer
OpenSSH flaw lets attackers log into password-disabled Linux accounts
Biz & IT - Ars Technica
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Full coverage · 7 sources
- 13h ago ↗
Biz & IT - Ars Technica
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices - 19h ago ↗
- 20h ago ↗
The Hacker News
OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux - 22h ago ↗
Hacker News: Front Page
Alpine Linux Security advisory: OpenSSH-server password authentication bypass - 1d ago ↗
Hacker News: Front Page
OpenSSH 10.6p2 Critical workaround for alpine without PAM - 1d ago ↗
- 1d ago ↗
Hacker News: Front Page
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability
What developers are saying
Based on 193 comments · Mixed reactions
Commenters treat the flaw as a serious problem rooted in musl's crypt() behaviour and praise the fast release, though some argue it reflects broader problems with C code and Alpine. Others say their own setups were unaffected, and some question whether the default Alpine install is vulnerable at all.
- musl crypt() design flaw25%
- Praise for fast disclosure15%
- Whether Alpine defaults are affected15%
- Disable password authentication advice20%
- Criticism of C and distro choices25%
In favour
- + Fast release is justified by rapid rediscovery of bugs by AI agents and the risk of long embargoes
- + Disabling password authentication is a sound general hardening step
Concerns
- − musl's crypt() returning '*' as an error indicator is seen as an unsafe API choice
- − The default Alpine install may not be affected because it uses '!' as the shadow placeholder
- − A workaround rather than a fix raises questions
- − Following the advice blindly could lock administrators out of machines
- − Docker containers are often slow to update their base images
“The musl code in question is nuts. The API it implements is awful.”
“i think it's just unbelievable there isn't a bigger push to move away from c to languages that can prevent stuff like this from happening.”
“By blindly (or agenticly) following those instructions the risk is getting locked out of some machine.”
First seen · 7 sources · 193 comments · Full story page · How tiers are decided