The OpenSSH flaw nicknamed *sshole lets attackers break into Alpine Linux servers — and other systems based on the musl C library — using only a long password of 257 to 1,024 characters. Researcher Özgün Kültekin of security firm Wakefield disclosed the vulnerability on November 5, 2026, and the fix is already available in OpenSSH 10.6p2, released the same day. CSO Online identifies the flaw as CVE-2026-123158.
The attack requires no credential guessing and no brute force: a single login attempt with a long password against an account that should never accept passwords — such as root or key-only SSH accounts — is enough.
How the OpenSSH flaw works
The problem comes from three old decisions combined. In 2012, musl developers capped passwords at 256 bytes to prevent denial-of-service attacks with slow SHA-512 hashes — and made the crypt() function return an asterisk (*) when it cannot compute a hash. In 2016, OpenSSH started “borrowing” the salt from another account to simulate password verification for nonexistent users, as a defense against username enumeration (CVE-2016-6210). And passwordless accounts carry exactly an asterisk in the password field of /etc/shadow.
When an attacker sends a password longer than 256 characters to one of those accounts, musl fails to compute the hash and returns * — which matches the stored asterisk. The server concludes the password is correct and grants access.
Who is exposed
An attacker can only exploit the OpenSSH flaw when all of these conditions meet: the system uses musl (the case of Alpine Linux, widely used in Docker containers and the cloud); OpenSSH runs without the PAM module; password authentication is enabled; there is an account with an asterisk in its password field; and there is another account with a valid password hash ($5$ or $6$) to borrow the salt from.
The most serious case is Alpine Linux's official cloud images, versions 3.18.11 to 3.24.3: there, the default alpine user has passwordless doas permission — the lightweight sudo equivalent. Anyone who logs in as alpine can become root with a single command. Direct root login remains limited by the default PermitRootLogin prohibit-password setting, but this path bypasses that protection.
Popular distributions such as Debian, Ubuntu and Fedora are not affected, because they use glibc instead of musl. There is no indication that vulnerable systems have been exploited, according to The Register.
The fix and what to do
OpenSSH 10.6p2, released on November 5, fixes the OpenSSH flaw, and Alpine published patched packages for all versions back to 3.16. Anyone running Alpine servers should update as soon as possible. Those who cannot update should disable password authentication in OpenSSH and restart the daemon, switching to SSH keys only. The researcher also published a simple command to check whether any passwordless account recently received a password login.
Image credit: Alpine Linux logo, via Wikimedia Commons.
Sources
- The Register — Get root on a musl Linux system by slamming it with an overly long password
- CSO Online — OpenSSH flaw lets attackers access password-disabled accounts on some Linux systems
- sshhole.com — technical writeup by Özgün Kültekin (Wakefield)
Transparency: this article was produced with the assistance of artificial intelligence, cross-checked against public posts and sources on the internet. Please consult the original sources to confirm the information.
Muse
.webp)