🔍 Read the full analysis: OpenSSH SSHole Bug: Questions To Ask About Your Linux Server on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
OpenSSH released version 10.6p2 on Nov. 5 to fix CVE-2026-123158, a password-authentication flaw affecting a narrow set of Linux systems using musl without PAM. Administrators should check whether all five exposure conditions apply, update and restart sshd, or disable password authentication until they can patch.
OpenSSH released version 10.6p2 on Nov. 5 to fix CVE-2026-123158, a vulnerability that can allow passwordless logins on certain Linux servers. The flaw, called “sshole” by its finder, applies only when a specific combination of musl, SSH password-authentication and account settings is present; reports say exploit code appeared within hours of the fix.
The vulnerability arises when sshd checks passwords without PAM on a Linux system using the musl C library. According to Alpine Linux’s advisory, musl’s crypt() function returns an asterisk when it receives a password longer than 256 bytes. On affected configurations, that error value can match the asterisk stored for an account without a password, causing sshd to accept the login. The source account must also have at least one local account with a $5$ or $6$ password hash, Alpine says.
Alpine lists five conditions that must all apply: Linux with musl; sshd checking passwords without PAM; PasswordAuthentication enabled; an account whose password field is *; and a local account with a $5$ or $6$ hash. Alpine’s standard openssh-server package is a known example. Alpine also warned that some official tiny-cloud images from versions 3.18.11 through 3.24.3 can become vulnerable after a qualifying password hash is added.
OpenSSH 10.6p2 contains the fix. Alpine says fixed packages are available across its branches, including older releases. Administrators who cannot update immediately can set PasswordAuthentication no, then check authentication logs for suspicious password logins to accounts that should not accept passwords. After updating, they must restart sshd: Alpine cautions that replacing the package alone does not replace the running daemon.
OpenSSH SSHole Bug Questions for Linux admins
OpenSSH 10.6p2 fixes a password-authentication flaw in a narrow set of Linux configurations. Check all five exposure conditions, then patch and restart sshd.
Who may be exposed?
Linux alone does not determine exposure: every listed condition must be present.
The system uses the musl C library.
sshd checks passwords without PAM.
PasswordAuthentication is enabled.
An account has * in its password field.
At least one local account has a $5$ or $6$ password hash.
What should you do?
Prioritize systems that meet all five conditions.
Install the fixed package
Use OpenSSH 10.6p2 or a vendor package containing the fix.
Restart sshd
Replacing the package alone does not replace the running daemon.
Reduce password access
Set PasswordAuthentication to no until you can patch, and review authentication logs for suspicious password logins.
Scope depends on configuration
Check the actual system and vendor guidance before drawing conclusions.
- Alpine Linux’s standard openssh-server package is a known example.
- Some Alpine tiny-cloud images may become vulnerable after a qualifying password hash is added.
- Embedded systems using musl may also warrant review.
- Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable.
- Red Hat says its products are unaffected.
- Follow your vendor’s advisories for the systems you operate.
Which SSH Servers Face Exposure
The flaw matters because SSH is a common route for administrators to manage Linux servers remotely. On a system that meets the listed conditions, an attacker who can reach the SSH service may be able to log in to an account with a locked or unset password field. If that account has permission to become root, the consequences could extend beyond the initial account; Alpine specifically warns that passwordless privilege escalation can undermine reliance on OpenSSH’s default root-login restriction.
Reports indicate the window between patch release and public exploit availability was short. According to GreyNoise and BleepingComputer, exploit code appeared about four hours after OpenSSH published the fix, and GreyNoise recorded a first successful break-in on one of its sensors about 40 hours after release. CISA added the vulnerability to its exploited-vulnerabilities list on Nov. 9. These reports make prompt review relevant, but they do not establish that every Linux server—or any particular reader’s server—was exposed.
The reported scope is limited. Ubuntu says its OpenSSH builds use glibc and PAM and are not vulnerable; Red Hat also says its products are unaffected. The practical priority is to identify systems using musl and verify their exact SSH configuration rather than assume that all Linux machines share the exposure.
Products Worth Considering
DJI Mini 3 Drone with DJI RC and 3-Axis Mechanical Gimbal
Amazon Kindle Paperwhite (2024, 16 GB) – 7-inch Glare-Free Display, Black
Anker SOLIX C300 DC Portable Power Station with 60W Solar Panel, 288Wh, 300W
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
OpenSSH’s server normally compares a supplied password with the account’s stored password information. On the affected path, sshd calls the C library’s crypt() function. Alpine’s explanation is that musl returns * as an error indicator for a key longer than 256 bytes, while an account with no password can have the same character in its stored field. The matching values can make a failed password-hash operation look like a successful match.
OpenSSH says the root cause is outside sshd, although the flaw can be exploited through sshd and avoided there. Musl maintainer Rich Felker disputed that characterization, calling the problem an erroneous use by the caller and saying musl may change the mechanism in an upcoming release cycle. The disagreement concerns where the defect belongs; the OpenSSH fix is available regardless.
The supplied account says the researcher credited “agent swarms” in finding the issue, while OpenSSH said AI agents can rediscover bugs sometimes within hours. Those comments describe the parties’ views on the discovery and patching process, not independent proof that AI caused the vulnerability or the exploit activity.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long.”
— Alpine Linux advisory
What Administrators Still Need to Verify
Exposure cannot be determined from the operating system name alone. Administrators need to confirm the C library, whether sshd uses PAM, the value of PasswordAuthentication, account password fields and whether a qualifying local password hash exists. The supplied material identifies Alpine as the best-known case, but says embedded systems built with OpenWrt, Buildroot or Yocto may also use musl. Medcrypt reported reproducing the flaw on a stock Yocto image; that report does not establish the configuration or exposure of every Yocto-based device.
The available information does not identify the number of affected servers or establish the extent of successful attacks. GreyNoise’s report concerns a successful break-in observed on one of its sensors, not a count of compromised systems generally. It is also not clear from the supplied material how quickly all downstream vendors and device makers will issue fixes, or which long-lived embedded products will receive updates.
Patch, Restart and Review Access
Administrators should first determine whether their servers meet all five conditions, then install a vendor package containing the OpenSSH 10.6p2 fix and restart sshd. Alpine advises using its package upgrade process and restarting the service so the patched daemon is actually running. Where an immediate update is not possible, disable password authentication and check logs for password-based access to accounts that should not have passwords.
Organizations using embedded Linux should check with their operating-system or device vendor about the underlying C library, PAM configuration and available package updates. The supplied source does not give a single update date for every affected platform. Admins should also follow relevant vendor advisories and review the CISA listing as response guidance develops.
Key Questions
Is every Linux server vulnerable to SSHole?
No. The reported issue requires a specific combination: Linux using musl, sshd checking passwords without PAM, password authentication enabled, an account with a * password field and at least one local $5$ or $6$ hash.
What should administrators do first?
Check whether the server meets all five conditions. If it does, install a fixed OpenSSH package and restart sshd. If you cannot patch immediately, disable password authentication and review authentication logs.
Are Ubuntu and Red Hat systems affected?
Ubuntu says its OpenSSH builds use glibc and PAM and are not affected. Red Hat says its products are not affected. Administrators should still follow their vendor’s security advisories for the systems they operate.
Does installing the update complete the fix?
Not by itself. Alpine says the running sshd process must be restarted after the package is updated so the patched daemon is in use.
Have attackers exploited the flaw?
The supplied reporting says GreyNoise observed a successful break-in on one sensor about 40 hours after the fix was released, and CISA listed the vulnerability as exploited on Nov. 9. The material does not establish the overall number of affected or compromised systems.
Source: ThorstenMeyerAI.com
