OpenSSH Patches SSHole Authentication Bypass Affecting Some Linux Configurations
Summary
OpenSSH 10.6p2 fixes SSHole (CVE-2026-123158), an authentication bypass affecting certain musl-based Linux systems with PAM disabled. Attackers may log in using a 257–1,024-character password; no exploitation reports were known.
Key points
- SSHole is tracked as CVE-2026-123158 and has a reported CVSS score of 8.1.
- The flaw affects OpenSSH server deployments using musl libc with PAM disabled; the article says the defect is not in sshd itself but can be exploited via sshd.
- The bypass can work with a password between 257 and 1,024 characters when the target configuration has an account with a "*" password field and another local account with a $5$ or $6$ password hash.
- Alpine Linux identified affected releases from 3.16 through 3.24 and edge, including releases no longer regularly supported.
- OpenSSH fixes are included in version 10.6p2. Alpine advises applying the patches and restarting sshd, or disabling password logins and restarting the daemon.
- The article reports no known exploitation at the time, while security experts warn that public details and the simple, single-connection attack could prompt scanning.
Article Details
- Vulnerability Types
- SSH authentication bypass
- Password-hash interpretation flaw
- Severity
- High (CVSS 8.1)
- Affected Versions
- Alpine Linux 3.16–3.24
- Alpine Linux edge
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Disable password-based authentication and restart sshd.
- Apply the OpenSSH patches and restart sshd to replace the running daemon.
MITRE ATT&CK
CVE
People
Damien MillerAn OpenSSH developer who described the flaw and the reason for the rapid release.Fredrik AlmrothDetectify co-founder and principal security researcher who said no exploitation reports had been seen and assessed the likelihood of scanning.Jake KnottWatchTowr head of threat intelligence who warned that SSH brute-forcers might attempt the attack and recommended updating or disabling password authentication.Ozgun KultekinA Wakefield security researcher cited on the affected account configurations.
Products
Alpine LinuxOn Thursday, Alpine Linux urged users to immediately apply the OpenSSH patches and restart sshd to replace the running daemon, or disable password logins and restart sshd.musl libcof 8.1), the security defect affects the OpenSSH server (sshd) on Linux distributions that use the musl libc implementation with the Pluggable Authentication Module (PAM) disabled.OpenSSHOpenSSH has rolled out emergency patches for a high-severity authentication bypass that allows attackers to log in using very long passwords.