🔍 Read the full analysis: A Guide To The OpenSSH SSHole Bug And Its Potential Server Impact on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
OpenSSH fixed CVE-2026-123158, nicknamed SSHole, in version 10.6p2 on November 5, 2026. The password bypass affects a specific combination of Linux, musl, OpenSSH without PAM and enabled password authentication—not standard glibc-based builds, according to distribution advisories. Administrators should update and restart sshd, or disable password authentication if they cannot update.
OpenSSH released version 10.6p2 on November 5 to fix CVE-2026-123158, a password-authentication bypass that can expose certain Linux servers using the musl C library. The flaw, nicknamed SSHole and rated High at 8.1, applies only when several configuration conditions coincide; administrators of affected systems should update and restart the SSH server or disable password logins.
The issue arises when OpenSSH checks passwords without PAM on a Linux system using musl. According to the Alpine Linux advisory, musl’s crypt() function returns an asterisk as an error indicator for input longer than 256 bytes. On accounts whose stored password field is also an asterisk, the failed password calculation can appear to match. A login attempt with a password between 257 and 1,024 bytes may then be accepted under the affected conditions.
Alpine says the bypass also requires password authentication to be enabled, an account with an asterisk in its password field, and at least one local account with a $5$ or $6$ password hash. The flaw can therefore affect some accounts intended for key-only access. Alpine identifies its standard openssh-server package as a known case and lists OpenWrt, Buildroot and Yocto as environments that may warrant checking; the presence of one of those systems alone does not establish that a server is vulnerable.
Exploit code appeared publicly about four hours after the fix, according to GreyNoise and BleepingComputer. GreyNoise reported its first successful intrusion on a sensor about 40 hours after the release. CISA added CVE-2026-123158 to its list of exploited vulnerabilities on November 9. Those reports indicate exploitation has been observed, but they do not establish how many systems have been compromised.
OpenSSH SSHole Bug Who May Be Affected
CVE-2026-123158 is a password bypass tied to a specific combination of Linux, musl and OpenSSH settings. Administrators should check their actual server build and configuration.
When exposure may occur
The reported bypass requires several conditions to coincide.
The server uses the musl C library.
The password check runs without PAM.
An account has an asterisk in its stored password field, and a local account has a $5$ or $6$ hash.
How the check can fail
A long password can trigger a library error value that resembles a stored account value.
- musl crypt() returns an asterisk for input longer than 256 bytes.
- Some accounts also have an asterisk in the stored password field.
- A password between 257 and 1,024 bytes may be accepted under the affected conditions.
- Some accounts intended for key-only access may be reachable.
Distribution guidance
A distribution name alone does not determine whether a custom or embedded server is vulnerable.
| Environment | Supplied guidance |
|---|---|
| Alpine Linux | Standard openssh-server package is a known case; fixed packages are listed across branches. |
| OpenWrt, Buildroot, Yocto | May warrant checking; verify each build and its settings. |
| Debian, Ubuntu, Red Hat | Standard builds are reported as not affected; custom builds still need local checks. |
What administrators should do
Check the running server and take action based on its build and configuration.
- Verify whether Linux uses musl and whether sshd uses PAM.
- Check password authentication and relevant account password fields and hashes.
- Install the fixed package and restart sshd; if you cannot update promptly, set PasswordAuthentication no.
- Review authentication logs for password logins to accounts intended to have no password, then assess suspicious access under normal incident-response procedures.
Exposure Depends on Server Configuration
The reported risk is concentrated in a specific combination of software and settings, rather than applying to every OpenSSH server. Still, an internet-accessible SSH service can provide a direct route into a machine if it meets the conditions. An account designed not to accept password logins may be reachable, and Alpine warns that an affected user could gain further privileges if it can use tools such as passwordless doas.
The gap between the patch and public exploit code was short: the source reports roughly four hours. That timeline, alongside GreyNoise’s report of a successful attempt on a sensor, gives administrators reason to treat patching as time-sensitive. It does not mean all exposed servers were attacked, or that the reported sensor event represents the full scale of activity.
For administrators, the key practical point is to verify the actual build and configuration rather than infer exposure from a distribution name. Standard builds from Debian, Ubuntu and Red Hat say they are not affected, but embedded or custom Linux images may have different libraries and authentication settings.
Products Worth Considering
EcoFlow Delta 3 Max Portable Power Station with 220W Solar Panel, 2048Wh
DJI Mini 4K Drone with 4K UHD Camera
LG UltraGear 32GX850A-B 32-inch 4K UHD OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
OpenSSH says the root cause is outside sshd, though the issue is exploitable through the server and can be avoided there. The dispute reflects how the bug crosses a boundary: sshd uses the C library’s password-checking function, and the library’s error marker can resemble a stored value for a locked or passwordless account.
OpenSSH shipped the fix as version 10.6p2. Alpine published fixed packages across branches from edge back to 3.16, according to the supplied advisory. Alpine cautions that installing a package is not enough by itself: administrators must restart sshd so the running daemon uses the fixed code.
Distribution statements narrow the likely exposure. Ubuntu says its OpenSSH build links against glibc and uses PAM; Red Hat says its products are not affected. Debian’s tracker rates the issue “unimportant” for its packages and lists the upstream fix in its unstable branch. These statements concern those distributions’ packages and should not be taken as a blanket finding about custom builds.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.”
— Alpine Linux advisory
Custom Builds Need Local Checks
The supplied information does not establish how many servers are exposed or how many successful intrusions have occurred. GreyNoise’s sensor observation confirms a reported successful attack, not a global count. It is also not clear which individual OpenWrt, Buildroot or Yocto deployments meet every required condition; those environments can use different libraries, packages and settings.
The precise division of responsibility between OpenSSH and musl remains contested. OpenSSH attributes the root cause to behavior outside sshd, while musl maintainer Rich Felker calls the issue an erroneous use by the caller and says musl may change the mechanism in an upcoming release cycle. The supplied source does not give a release date or confirm a final change.
Administrators also need to determine whether an affected machine was reached before patching. The source recommends checking logs for password logins to accounts with no password, but it provides no detailed log-detection criteria or confirmed method for determining whether an individual login led to further access.
Patch, Restart and Review Logs
Administrators should first check whether their server runs Linux with musl and whether sshd uses PAM. They should then verify password authentication settings and whether accounts with an asterisk password field and local $5$ or $6$ hashes are present. If all listed conditions apply, the recommended action is to install the fixed OpenSSH package and restart sshd.
If an update cannot be applied promptly, the source recommends setting PasswordAuthentication no. After patching or disabling password logins, administrators should review authentication logs for password logins to accounts intended to have no password, and assess any suspicious access under their normal incident-response procedures. The supplied material does not specify a universal log query or a confirmed compromise count.
Alpine’s package guidance covers branches back to 3.16, including releases no longer receiving regular updates. Teams running embedded images or custom builds should check their vendor or image maintainer’s advisory rather than assume a standard distribution package applies. Further developments may include musl changes and additional findings about affected deployments or exploitation.
Key Questions
What is the OpenSSH SSHole bug?
CVE-2026-123158 is a password-authentication bypass in a narrow OpenSSH configuration. On affected Linux systems, an unusually long password can trigger a musl error value that matches the stored field for some accounts.
Which servers may be affected?
Servers must meet several conditions: Linux with musl, OpenSSH checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and at least one local account with a $5$ or $6$ hash. Check the actual build and settings; a platform name alone does not confirm exposure.
Are Debian, Ubuntu and Red Hat systems vulnerable?
The supplied advisories say their standard OpenSSH builds are not affected: Ubuntu cites glibc and PAM, Red Hat says its products are not affected, and Debian rates the issue unimportant for its packages. Custom or embedded builds may differ.
How should administrators respond?
Install OpenSSH 10.6p2 or the fixed package supplied for your system, then restart sshd. If you cannot update, disable password authentication with PasswordAuthentication no and review logs for password logins to accounts intended to have no password.
Has exploitation been confirmed?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the fix was released, and CISA added the vulnerability to its exploited-vulnerabilities list on November 9. The supplied information does not give a total number of compromised servers.
Source: ThorstenMeyerAI.com
