Security · High impactFan score 96 · Tier S19 sources193 comments in the community

Re: "sshole": password authentication bypass: OpenSSH + musl libc

The Brief

OpenSSH 10.6p2 was released with a workaround for a critical flaw, CVE-2026-123158 (nicknamed *sshole), that affects Linux systems using musl libc without PAM.
On affected systems, some accounts accept any password between 257 and 1024 characters, which lets attackers log into accounts that have no password, such as key-only accounts.
Help Net Security reports that threat intelligence firm Previdian has warned the flaw is already being exploited in the wild.

Why it matters

Servers running Alpine or other musl-based distributions without PAM may accept logins to passwordless accounts over the network, so exposed SSH hosts and Alpine-based containers should be patched or hardened now.

Who’s affected

Alpine Linux server operators
Teams running Alpine-based Docker images
Linux systems using musl libc without PAM

What to do

Upgrade OpenSSH to 10.6p2 or apply the workaround
Set PasswordAuthentication no in sshd configuration and restart sshd
Verify that public key login works before disabling password authentication to avoid lockout
Update base images of Alpine-based containers

OpenSSH 10.6p2
CVE-2026-123158
#openssh
#alpine-linux
#musl
#authentication-bypass
#ssh
#vulnerability

Posted by Michael Orlitzky on Nov 05 The PORTABILITY NOTES go on to say, The behavior of crypt on errors isn't well standardized. Some implementations simply can't fail (except by crashing the program), others return a null pointer or a fixed string. Most…

Read the full story at seclists.org ↗

What developers are saying

Based on 193 comments · Mixed reactions

Commenters largely agree the bug is a serious musl and crypt() design problem and that disabling password authentication is good practice. Some criticise the musl API and Alpine's track record, and others argue the risk is overstated for most setups, while praising the fast release and short embargo.

musl crypt() error handling30%
Disable password auth or use certificates25%
Alpine and Docker exposure20%
Praise for fast disclosure15%
Criticism of C and memory safety10%

In favour

+ Fast release and short embargo are seen as reasonable given rapid rediscovery by AI agents
+ Disabling PasswordAuthentication is sound hardening regardless of this bug
+ Certificate-based SSH setups were not affected

Concerns

− musl crypt() error behaviour and API are seen as poor design
− Alpine-based Docker images may stay unpatched for a long time
− Following the mitigation without checking key auth risks lockout
− The release is called a critical workaround but is not listed on OpenSSH's security page