International
The Morning Dev

Only the news worth knowing

‹
 

Security · High impactFan score 93 · Tier S32 sources

Re: "sshole": password authentication bypass: OpenSSH + musl libc

oss-security ·

The Brief · written from 32 sources

  • A decade-old OpenSSH flaw, nicknamed *sshole and tracked as CVE-2026-123158 with a CVSS score of 8.1, lets remote attackers log into passwordless accounts on some musl-based systems without PAM, such as Alpine Linux.
  • On affected systems, accounts accept a very long password (sources say 256 or more characters, or 257 to 1024 characters).
  • Previdian reports exploitation in the wild within hours of disclosure, and fixes are available.

Why it matters

If you run openssh-server on Alpine or another musl-based system without PAM, an account with no password may be reachable over SSH by anyone who sends a long password, so patch and check your exposure now.

Who’s affected

  • Alpine Linux users running openssh-server without PAM
  • Anyone running OpenSSH on musl libc systems without PAM

What to do

  1. Update openssh-server to the patched version provided by your distribution
  2. Check whether any accounts have no password set and are reachable over SSH

Posted by theknell on Nov 06 Said I'd figure it out, so here we go. Two things in this thread stayed stuck at the arguing stage: what crypt() actually hands back when it fails, in each implementation, and Jeff's timing point. I measured both, on my own machines —…

Read the full story at seclists.org ↗

What developers are saying

Based on 0 comments

Timeline

  1. Alpine Linux publishes an advisory on the openssh-server password authentication bypass

  2. Hacker News: Front Page

    OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability

  3. LWN.net

    Critical security vulnerability affects OpenSSH on Alpine Linux systems

  4. Hacker News: Front Page

    OpenSSH 10.6p2 Critical workaround for alpine without PAM

  5. Hacker News: Front Page

    Alpine Linux Security advisory: OpenSSH-server password authentication bypass

  6. The Hacker News

    OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

  7. BleepingComputer

    OpenSSH flaw lets attackers log into password-disabled Linux accounts

  8. Open Source Security

    Re: "sshole": password authentication bypass: OpenSSH + musl libc · +16 replies

  9. Biz & IT - Ars Technica

    Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

  10. OpenSSH fixes are released for the flaw

  11. Previdian reports that attackers are exploiting the flaw

  12. Risky.Biz

    Risky Bulletin: Some OpenSSH instances take any password longer than 256 characters

  13. SecurityWeek

    OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass

  14. Help Net Security

    OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)

  15. The Hacker News

    Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

  16. Techmeme

    Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)

  17. Step Security Blog

    CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux

  18. Lobsters

    Alpine Linux : openssh-server password authentication bypass

  19. Lobsters

    1 points · 0 comments

  20. SANS Internet Storm Center reports an increase in exploitation attempts

  21. SANS Internet Storm Center, InfoCON: green

    Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)

Full coverage · 32 sources

How do you feel about this?

0 Comments