TL;DR
A flaw tracked as CVE-2026-123158 can let attackers log in to some Linux accounts without a valid password when OpenSSH runs on musl without PAM and password authentication is enabled. OpenSSH released version 10.6p2 on November 5; public exploit code and reports of successful attacks followed. Affected administrators should update or disable password authentication and review login logs.
OpenSSH released a fix on November 5 for a flaw that can let attackers log in to certain Linux accounts without knowing a password, prompting a rapid response after exploit code became public and successful attacks were observed. The vulnerability, CVE-2026-123158, affects a narrow set of systems running OpenSSH with the musl C library, no PAM password checks, and password logins enabled; administrators can update to OpenSSH 10.6p2 or disable password authentication.
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The flaw, which its discoverer calls “SSHole”, arises when sshd checks passwords without PAM on Linux systems using musl. According to Alpine Linux’s advisory, musl’s crypt() function returns an asterisk (*) as an error indicator when a password exceeds 256 bytes. Some accounts that should not accept password logins have that same character in the password field. In the affected setup, the error value can therefore match the stored field and be treated as a successful password check.
An attacker can send an overlong password, between 257 and 1,024 bytes, to a reachable SSH service. Alpine says the bypass can work in one connection, but it requires particular conditions: among them, an account with a * password field and at least one local account with a $5$ or $6$ password hash. Alpine says sshd uses that account’s salt during the check. The precise configuration matters; having an SSH server alone does not establish that a system is vulnerable.
OpenSSH 10.6p2 contains the fix. According to GreyNoise and BleepingComputer, exploit code appeared about four hours after the release; GreyNoise reported its first successful break-in on a sensor roughly 40 hours after release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. The source material does not detail the affected sensor or the victim’s identity.
Why Small Linux Servers Need Attention
The vulnerability matters to administrators of Alpine Linux and other musl-based systems that expose SSH, especially where password authentication remains enabled. A login could give an attacker access as an account whose password field is an asterisk. The impact depends on that account’s permissions and on the server’s other controls; Alpine warns that an attacker might gain greater privileges if an accessible account can use a tool such as passwordless doas.
The reported exploitation makes patching time-sensitive for systems that meet the conditions. The account is not necessarily the root account: OpenSSH’s default setting blocks root password login, but an attacker might use another account and then elevate privileges if the machine’s configuration permits it. Administrators should treat exposure as a configuration question and check the actual operating system, SSH build, authentication method, account fields, and local password hashes.
Products Worth Considering
Apple Watch Series 12 GPS 42mm Smartwatch
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, and IPX4 Water Resistance
Anker SOLIX C1000 Gen 2 Portable Power Station with 200W Solar Panel
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
The issue depends on how two components handle an unusual input. OpenSSH’s password check calls the C library’s crypt() function when PAM is not used. In the described musl behavior, an input longer than 256 bytes produces * as an error indicator. If the account’s stored password field is also *, the failure value and stored value are identical at the comparison step. Alpine’s advisory describes that match as the point at which the login can succeed.
The source identifies Alpine’s standard openssh-server package as a known case. The researcher also names OpenWrt, Buildroot, and Yocto, but the source does not establish that every installation of those systems is vulnerable. Alpine lists several requirements, including password authentication being enabled and an account with the matching field. Its official tiny-cloud images from versions 3.18.11 through 3.24.3 are described as becoming exploitable once a $6$ hash exists on the machine.
Ubuntu says its OpenSSH builds use glibc and PAM and are not affected. Red Hat also says its products are not affected. Debian’s security tracker rates the issue “unimportant” for its packages and lists upstream version 1:10.6p2-1 as fixed in its unstable branch. The source also lists non-Linux systems, glibc-based Linux systems, PAM-based password checks, disabled password authentication, Dropbear, and containers that do not run sshd as outside the described exposure.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password, so the ‘hash’ matches and the login succeeds.””
— Alpine Linux advisory
Which Embedded Systems Are Exposed
The source does not provide a complete inventory of affected devices, packages, or deployments. It names several embedded Linux environments, while also describing conditions that must all be met. Medcrypt reported on the oss-security mailing list on November 9 that it reproduced the issue, including on a stock Yocto image, but that report does not establish how widely affected configurations are deployed.
The source also does not identify the system involved in GreyNoise’s first observed successful break-in or give details about the attacker, account, or access gained. OpenSSH and musl differ on whether the root cause belongs in the SSH caller or the library. Felker said musl may change the mechanism in a future release cycle; the source gives no release date or final design.
Patch and Review SSH Access
Administrators should install OpenSSH 10.6p2 or a distribution update containing the fix, then restart sshd as required by their system. If they cannot update promptly, the stated mitigation is to set PasswordAuthentication no and use another configured access method. They should also review SSH authentication logs for password logins to accounts that have no password, and check whether any such account can gain elevated privileges.
Teams managing Alpine, embedded Linux, or custom images should compare their exact build and SSH configuration against Alpine’s listed conditions and their vendor’s security notice. Further updates may clarify musl’s planned change and the exposure of specific embedded products. The source does not give a deadline for those updates or report a complete count of affected systems.
Key Questions
What is CVE-2026-123158?
It is an OpenSSH password-checking flaw that can permit a passwordless login on some Linux systems using musl, when sshd checks passwords without PAM and password authentication is enabled.
Does the flaw affect every Linux server?
No. The described bypass requires a specific combination of library, authentication settings, and account conditions. Ubuntu and Red Hat say their OpenSSH builds are not affected; administrators should check their distribution’s advisory and configuration.
How can administrators reduce the risk?
Update to OpenSSH 10.6p2 or a distribution package with the fix. If that is not immediately possible, disable password authentication and review SSH logs and account permissions.
Has the flaw been exploited?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the fix was released. CISA added the flaw to its exploited vulnerabilities list on November 9. The source does not identify the affected sensor or provide a broader incident count.
Source: Thorsten Meyer AI
