🔍 Read the full analysis: What The OpenSSH SSHole Bug Means For Linux Server Security on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
OpenSSH’s CVE-2026-123158, dubbed “SSHole,” can allow passwordless logins on a narrow set of Linux systems using musl, without PAM, and with password authentication enabled. OpenSSH released a fix in version 10.6p2; administrators should update and restart sshd, or disable password authentication while arranging an update.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a flaw that can let attackers log in without a valid password on some Linux servers. The vulnerability, dubbed “SSHole” by its finder and rated High at 8.1, affects a limited combination of musl-based systems, SSH settings and account configurations—not Linux servers generally.
The bypass occurs when OpenSSH checks passwords without PAM on a system using the musl C library. Alpine Linux’s advisory says musl’s crypt() function returns an asterisk as an error indicator when a password exceeds 256 bytes. Some accounts that should not accept password logins also have an asterisk in the password field. In the affected configuration, those matching values can cause sshd to treat a failed password check as a match.
For the issue to be exploitable, the conditions must coincide: sshd must run on Linux with musl, password checks must happen without PAM, password authentication must be enabled, an account must have an asterisk in its password field, and another local account must have a $5$ or $6$ password hash. Alpine is the best-known affected case. The researcher also named OpenWrt, Buildroot and Yocto, but exposure depends on the specific build and configuration.
Exploit code became public about four hours after the fix, according to GreyNoise and BleepingComputer. GreyNoise reported its first successful break-in on a sensor about 40 hours after the release. CISA added the flaw to its list of exploited vulnerabilities on November 9. Those reports indicate observed exploitation, but do not establish how many servers were compromised overall.
What SSHole means for Linux server security
OpenSSH’s SSHole flaw can bypass password checks on a narrow set of Linux configurations. Operators should verify exposure, patch, restart sshd, and review logs.
Exposure requires several conditions
The reported bypass applies only when the relevant system, SSH settings, and account configuration coincide.
Linux must use the musl C library.
Password checks must run without PAM, with password authentication enabled.
The required asterisk password field and qualifying local password hash must be present.
Project names do not prove exposure
Check each build and configuration individually, especially on embedded systems.
- glibc-based Linux systems
- Systems using PAM for password checks
- Systems with password authentication disabled
- Non-Linux systems and Dropbear
- Alpine Linux systems
- OpenWrt, Buildroot, and Yocto builds
- Custom and embedded installations
Remediate and investigate
A package update alone does not replace the running daemon.
Install a fixed package
Use OpenSSH 10.6p2 or the fixed package supplied by your distribution.
Reload patched sshd
Restart the SSH daemon so it runs the updated code.
Disable password authentication
If an update must wait, set PasswordAuthentication no if access requirements allow.
Inspect SSH logs
Investigate password logins to accounts that have no password. Logs alone may not confirm whether a host was compromised.
Exposure Depends on Server Configuration
The flaw matters because a reachable SSH service is often an administrative entry point, and the reported bypass does not require an attacker to know an account’s password. If a vulnerable host also gives the reachable account elevated privileges—directly or through tools such as doas—the consequences could extend beyond that account. Alpine specifically warns that its default root-login restriction does not protect a system when another login-capable user can become root.
At the same time, the affected configuration is narrow. Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable; Red Hat says its products are not affected. Debian’s tracker rates the issue unimportant for its packages. Those statements do not replace checking a server’s actual operating system, package and SSH settings, particularly on embedded or custom-built systems.
Public exploit code and reported successful activity make prompt remediation relevant for operators whose systems meet the conditions. The vulnerability is a software and configuration risk, not evidence that every Linux server or SSH connection is exposed. Administrators should also remember that security incidents cannot be ruled out solely because a package has now been updated.
Products Worth Considering
Logitech MX Vertical Wireless Ergonomic Mouse
Apple MacBook Air 15-inch (2026) with M5 Chip, 16GB Memory, 1TB SSD, and Liquid Retina Display – Sky Blue
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
How the Asterisk Check Failed
On many Linux systems, an asterisk in an account’s password field represents an account that cannot authenticate with a password. The failure arose from how certain versions and configurations of sshd compare a supplied password with that stored field after calling the system’s crypt() function. When an overlong input caused musl to return an asterisk as an error marker, the error could resemble the account’s stored value.
Responsibility for the underlying behavior is disputed. OpenSSH said the root cause was outside sshd, though the issue was exploitable through sshd and could be avoided there. Musl maintainer Rich Felker said the library’s behavior was not a bug and characterized the problem as an erroneous use by the caller; he also said musl might change the mechanism in an upcoming release cycle. The OpenSSH 10.6p2 release supplies a fix at the SSH server level.
Not every system with musl is affected. Systems using PAM for password checks, systems with password authentication disabled, non-Linux systems, glibc-based Linux systems and systems running Dropbear are listed as not affected by the advisories. Alpine’s official tiny-cloud images from versions 3.18.11 through 3.24.3 require particular attention, according to Alpine: they include an account with an asterisk password field and passwordless doas, and become exploitable once a qualifying password hash exists.
““We consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there.””
— OpenSSH
Embedded Builds Need Verification
The precise number of exposed or compromised systems is not established in the supplied advisories and reports. GreyNoise’s sensor observation confirms activity against at least one sensor, not the overall scale of exploitation. Exposure across OpenWrt, Buildroot and Yocto installations also cannot be inferred from those project names alone; their library, PAM use, password settings and account records must be checked individually.
Medcrypt reported on the oss-security mailing list on November 9 that it had independently reproduced the issue, including on a stock Yocto image. That report points to possible exposure in embedded builds, but does not establish that all Yocto images or deployed devices are vulnerable. The disagreement between OpenSSH and musl over the root cause also remains unresolved in the cited material.
Patch, Restart, Review Logs
Administrators should install OpenSSH 10.6p2 or a vendor-provided fixed package and restart sshd so the running daemon uses the patched code. Alpine says fixed packages are available across its branches, including older releases. Package names and update commands vary by distribution; operators should use the relevant vendor’s security advisory rather than assume the upstream version number maps directly to their package.
If an immediate update is not possible, set PasswordAuthentication no as a temporary measure, provided that change fits the server’s access requirements. Administrators should review SSH logs for password logins to accounts that have no password and investigate activity that cannot be explained. Log review may help identify suspicious access, but the source material does not specify a complete set of indicators or establish that log records alone can confirm whether a host was compromised.
After remediation, operators of custom and embedded systems should verify whether sshd uses musl, whether PAM is involved, and whether the relevant authentication and account conditions are present. Further guidance may follow from distribution maintainers and musl as package fixes and any library changes are released.
Key Questions
Which Linux servers are vulnerable to SSHole?
Only systems meeting all the reported conditions are affected: Linux with musl, OpenSSH password checks without PAM, password authentication enabled, an account with an asterisk in its password field, and a local account with a $5$ or $6$ password hash. Check the specific system rather than relying on its distribution name alone.
Are Ubuntu, Debian and Red Hat systems affected?
Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable. Red Hat says its products are not affected, while Debian’s tracker rates the issue unimportant for its packages. Administrators should still consult the security information for their exact product and configuration.
How should administrators fix the vulnerability?
Install OpenSSH 10.6p2 or the fixed package supplied by the operating-system vendor, then restart sshd. If patching is delayed, disabling password authentication is a temporary mitigation where operationally appropriate.
Does installing the package finish the update?
No. Alpine warns that updating the package alone does not replace an already running SSH daemon. Restart sshd after the package update, then verify that the service is using the patched version.
Has widespread exploitation been confirmed?
The supplied reporting says GreyNoise observed a successful break-in on one sensor about 40 hours after the fix was released, and CISA listed the flaw among exploited vulnerabilities on November 9. The total number of affected or compromised systems is not established.
Source: ThorstenMeyerAI.com
