The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 96 · Tier S22 sources193 comments in the community

Re: "sshole": password authentication bypass: OpenSSH + musl libc

oss-security ·

The Brief

  • OpenSSH on musl libc systems without PAM accepts an oversized password of 257 to 1,024 bytes for password-disabled accounts, allowing login without the real password.
  • The flaw is tracked as CVE-2026-123158 with a CVSS score of 8.1 per The Hacker News, and is nicknamed *sshole.
  • OpenSSH 10.6p2 ships a workaround; the root cause is attributed to musl's crypt() returning '*' on error, and Previdian reported exploitation attempts within hours of disclosure.

Why it matters

If you run Alpine or another musl-based Linux with openssh-server and password authentication enabled, accounts that have no password (such as key-only accounts) can be logged into remotely. Patch or disable password authentication now.

Who’s affected

  • Alpine Linux servers running openssh-server
  • Operators of musl-based Linux systems without PAM
  • Teams shipping Alpine-based Docker images with OpenSSH

What to do

  1. Upgrade OpenSSH to 10.6p2 or later where possible.
  2. If you cannot upgrade yet, set PasswordAuthentication no in sshd_config and restart sshd.
  3. Verify that public key login works before disabling password authentication, to avoid being locked out.
  • OpenSSH 10.6p2
  • CVE-2026-123158
  • #openssh
  • #alpine-linux
  • #musl
  • #vulnerability
  • #ssh
  • #authentication

Posted by Steffen Nurpmeso on Nov 06 Martin Steigerwald wrote in <lAcUgmfSTD6YfF29yvDOHQ () lichtvoll de>: |Greetings. | |Matt Johnston - 06.11.26, 03:05:13 CET: |> Prior to ~2019 when the OpenSSH change was made, Debian |> would have shown a different manpage that only documents…

Read the full story at seclists.org ↗

What developers are saying

Based on 193 comments · Mixed reactions

Commenters on Hacker News largely agree the bug is serious and that disabling password authentication is a sound short-term mitigation. Disagreement remains over whether the workaround is enough, with some blaming musl's crypt() API and C in general, and others saying the root cause lies outside OpenSSH.

  • musl crypt() error handling30%
  • Disable password auth as mitigation20%
  • Criticism of C and Alpine20%
  • Docker image exposure15%
  • Embargo and AI rediscovery10%

In favour

  • + Disabling PasswordAuthentication is good practice in general
  • + Short embargo is justified given rapid rediscovery by AI agents

Concerns

  • − A workaround rather than a fix leaves the root cause open
  • − The musl crypt() API is error-prone and hard to call correctly
  • − Blindly following mitigation steps risks lockout without checking public key auth
  • − Docker images are often slow to update their base image

“Funnily enough, they don’t recommend checking pubkey auth is enabled and working.”

alanfranz on Hacker News

“This is brutal because a lot of docker containerized apps are very slow to update the base image if at all.”

nodesocket on Hacker News

“This looks terrible for musl, what a collection of terrible decisions on their part.”

K0nserv on Hacker News

Timeline

  1. OpenSSH 10.6p2 released with a workaround for the musl and PAM-disabled flaw

  2. Flaw publicly disclosed as *sshole

  3. Hacker News: Front Page

    OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability

  4. Hacker News

    170 points · 81 comments

  5. LWN.net

    Critical security vulnerability affects OpenSSH on Alpine Linux systems

  6. Hacker News: Front Page

    OpenSSH 10.6p2 Critical workaround for alpine without PAM

  7. Hacker News

    131 points · 7 comments

  8. Hacker News: Front Page

    Alpine Linux Security advisory: OpenSSH-server password authentication bypass

  9. Hacker News

    539 points · 105 comments

  10. The Hacker News

    OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

  11. BleepingComputer

    OpenSSH flaw lets attackers log into password-disabled Linux accounts

  12. Open Source Security

    Re: "sshole": password authentication bypass: OpenSSH + musl libc · +8 replies

  13. Biz & IT - Ars Technica

    Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

  14. Previdian reports exploitation attempts within hours of disclosure

  15. Risky.Biz

    Risky Bulletin: Some OpenSSH instances take any password longer than 256 characters

  16. SecurityWeek

    OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass

  17. Help Net Security

    OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)

  18. The Hacker News

    Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

  19. Techmeme

    Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)

  20. Step Security Blog

    CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux

Full coverage · 22 sources

How do you feel about this?

0 Comments