International
The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 97 · Tier S39 sources

Re: "sshole": password authentication bypass: OpenSSH + musl libc

oss-security ·

The Brief · written from 39 sources

  • Authentication bypass in OpenSSH (CVE-2026-123158), dubbed "SSHole", affects systems using musl libc without PAM.
  • BleepingComputer and SecurityWeek report active exploitation by botnets, crypto miners and other attackers; SANS saw rising exploit attempts in its honeypots.
  • Medcrypt reproduced the issue on a stock Yocto image; musl maintainer Rich Felker says behaviour may change to always return null on failure in the next release cycle.

Why it matters

Attackers are already exploiting this to run commands, steal credentials and establish persistent access, and the affected configuration can occur in stock or common builds.

Who’s affected

  • OpenSSH servers built against musl libc
  • Alpine Linux users
  • Embedded teams building Yocto images
  • Systems without PAM that have password authentication enabled

What to do

  1. Check whether your OpenSSH runs on musl libc without PAM and with password authentication enabled.
  2. Watch for an OpenSSH or musl fix and apply it as soon as it is released.

Posted by Loganaden Velvindron on Nov 09 This is the approach I'm taking on my build of Alpine Linux. I would like to also submit a patch to musl to have this as a build option. @musl, any interest in having this as a build option ?

Read the full story at seclists.org ↗

What developers are saying

Based on 0 comments

Timeline

  1. Hacker News: Front Page

    OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability

  2. LWN.net

    Critical security vulnerability affects OpenSSH on Alpine Linux systems

  3. Hacker News: Front Page

    OpenSSH 10.6p2 Critical workaround for alpine without PAM

  4. Hacker News: Front Page

    Alpine Linux Security advisory: OpenSSH-server password authentication bypass

  5. The Hacker News

    OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

  6. BleepingComputer

    OpenSSH flaw lets attackers log into password-disabled Linux accounts

  7. Open Source Security

    Re: "sshole": password authentication bypass: OpenSSH + musl libc · +18 replies

  8. Biz & IT - Ars Technica

    Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

  9. Risky.Biz

    Risky Bulletin: Some OpenSSH instances take any password longer than 256 characters

  10. SecurityWeek

    OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass

  11. Help Net Security

    OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)

  12. The Hacker News

    Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

  13. Techmeme

    Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)

  14. Step Security Blog

    CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux

  15. Lobsters

    Alpine Linux : openssh-server password authentication bypass

  16. Lobsters

    1 points · 0 comments

  17. SANS reports increased exploitation attempts in its honeypots after the vulnerability emerged the previous week

  18. SANS Internet Storm Center, InfoCON: green

    Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)

  19. SecurityWeek and BleepingComputer report active exploitation by botnets, crypto miners and other attackers

  20. SecurityWeek

    Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH

  21. BleepingComputer

    Hackers exploit SSHole OpenSSH flaw to breach Linux systems

  22. Open Source Security

    Re: [musl] Re: [oss-security] "sshole": password authentication bypass: OpenSSH + musl libc

  23. Schneier on Security

    New OpenSSH Vulnerability

  24. top scoring links : programming

    Why OpenSSH Accepts a Password It Shouldn’t | Patch Notes

Full coverage · 39 sources

How do you feel about this?

0 Comments