OpenSSH Password-Authentication Bypass Affects Certain musl-Based Linux Systems

Summary

CVE-2026-123158 (“SSHhole”) can bypass SSH password authentication on qualifying musl-based Linux systems, especially Alpine, when PAM is disabled. OpenSSH and Alpine have issued fixes; no in-the-wild exploitation was reported as of Nov. 6, 2026.

Key points

On affected systems, musl’s crypt() can return * for an overlong password; vulnerable sshd may match that error value to * in an account’s /etc/shadow entry.
The attack requires musl libc, SSH password authentication without PAM, and a qualifying account; an attacker does not need to know the account’s password.
Alpine Linux is the primary affected platform. The resulting access depends on the account’s privileges and could enable broader system compromise.
OpenSSH released Portable OpenSSH 10.6p2 on Nov. 5, 2026, and Alpine issued corrected packages for multiple branches.
Public reproduction material is available, but the article reports no confirmed exploitation in real-world attacks as of Nov. 6, 2026.
Install the corrected distribution package and restart sshd; if patching is delayed, disable password and keyboard-interactive authentication and restrict SSH access.
Monitor for unexpected successful password logins to key-only or service accounts, then investigate subsequent activity and privilege escalation.

Article Details

Vulnerability Types: SSH password authentication bypass
Authentication error-handling flaw involving musl libc crypt() returning an error value
Severity: High (CVSS 3.1: 8.1)
Affected Versions: OpenSSH sshd versions before Portable OpenSSH 10.6p2, when running on Linux with musl libc, without PAM, and with password authentication enabled
Exploitation Status: not_reported
Exploit Availability: public_poc
Patch Status: available
Workarounds: Disable SSH password authentication with PasswordAuthentication no.
Where applicable, disable keyboard-interactive authentication with KbdInteractiveAuthentication no.