A password that should never work can open the door. A newly disclosed flaw in OpenSSH, nicknamed SSHole and tracked as CVE-2026-123158, lets an attacker log in to some Linux servers simply by typing a very long password — no stolen credentials, no brute force, no zero-day exploit chain. The bug sat quietly in the code for roughly a decade, and within days of its disclosure, attackers were already trying it in the wild.
OpenSSH shipped the fix in version 10.6p2 on November 5, 2026, just one day after learning of the problem. But the fix only helps systems that actually receive it, and the servers most at risk — lightweight Alpine Linux machines, containers, and embedded devices — are exactly the ones that often go unpatched the longest.
What Is SSHole?
SSHole is a password authentication bypass in sshd, the OpenSSH server, rated CVSS 8.1 (High). It affects Linux systems built on the musl C library and running sshd without PAM (Pluggable Authentication Modules) — a combination that is the default for Alpine Linux’s openssh-server package, and also appears in OpenWrt, Buildroot, and Yocto-based systems.
The flaw lets an attacker log in to any account whose password field is a single asterisk (*) — the marker Unix systems use for accounts that are supposed to never accept a password login, such as the root account on Alpine or key-only service accounts. All the attacker needs is network access to the server, the account name, and a password between 257 and 1,024 bytes long. Any password in that range works.
Security researcher Özgün Kültekin of Wakefield reported the bug to OpenSSH on November 4, 2026, and the project shipped the workaround the next day. The flaw was later assigned CVE-2026-123158. According to The Hacker News, as of November 9, 2026, a total of 20 exploitation attempts had already been recorded from 13 unique IP addresses across Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the United States — and public proof-of-concept code is available.
How a 257-Character Password Beats the Login Check
The bug lives in the gap between two pieces of software that each made a reasonable decision on their own. Understanding it takes three ingredients, all documented in the researcher’s write-up at sshhole.com.
First, the asterisk. On Unix systems, an account that should never log in with a password gets * in its password field in /etc/shadow. A * is not a hash, so no password should ever match it. That convention dates back to 1980, when Bill Joy put a * next to the daemon account.
Second, musl’s crypt(). When password checking fails inside the C library’s crypt() function, it returns a single character instead of NULL, so programs do not crash — and the character musl chose is *. Since 2012, musl also caps passwords at 256 bytes for its SHA-512 crypt implementation, as a denial-of-service protection. Send a password longer than 256 bytes and crypt() fails — and returns *.
Third, a fix from 2016. A timing flaw tracked as CVE-2016-6210 let attackers work out which usernames existed on a server by measuring how long sshd took to answer. OpenSSH’s fix was to make sshd hash the submitted password even for accounts with no real hash, borrowing the salt from another account on the system, so every login attempt takes the same amount of time.
Put them together and the trap snaps shut. An attacker targets a * account and sends a password of 257 bytes or more. sshd borrows another account’s salt and calls crypt(). The password is too long, so musl’s crypt() fails and returns *. sshd compares that result with the stored password field — which is also *. They match. The door opens.
The researcher found the bug by building sshd in every combination he could think of — glibc, musl, PAM, no PAM, shadow, no shadow — and throwing around 17,600 unusual logins at it. Every build agreed on every login except musl without PAM, which said yes to things it should have rejected.
Who Is Affected — and Who Is Not
All four of these conditions must hold for a server to be vulnerable:
- sshd is built against musl libc and runs without PAM. Alpine Linux’s default openssh-server package has no PAM, or a PAM build with UsePAM no.
- Password authentication is enabled, which is the default.
- At least one account has exactly * as its password field — key-only users, LDAP users, or root on Alpine (which has used * since Alpine 3.16 in 2022).
- At least one other local account has a real password hash, so sshd has a salt to borrow.
That last condition sounds reassuring, but it is satisfied the moment anyone on the box has a password set. On Alpine’s official cloud images, the default alpine user has * in its password field and passwordless sudo-style access, so a successful bypass can mean root.
Just as important is who is not affected. Debian, Ubuntu, Fedora, Red Hat Enterprise Linux, and other glibc-based distributions are safe, as are any systems that check passwords through PAM, macOS, OpenBSD, and Dropbear. The SSH client on a laptop is not the problem — only the server side matters. The same November patch cycle that delivered Android’s November 2026 security update, which fixed a zero-click remote code execution flaw, shows how quickly the industry is moving on this wave of flaws, and the lesson is the same: know which of your systems are actually in scope.
The pattern fits a wider week for cryptography and security. DeepMind researchers recently showed AI agents probing weaknesses in 1024-bit RSA, and governments are responding with serious money — Japan’s ¥10 billion cybersecurity package is one example of the scale now involved. SSHole is a reminder that the oldest plumbing can be the weakest link.
Exploitation Is Already Underway
When OpenSSH and Alpine first disclosed the flaw on November 5, no exploitation had been observed. That window closed fast. By November 9, threat actors were actively attempting to exploit it, with 20 attempts recorded from 13 unique IP addresses. A public proof of concept appeared within hours of disclosure, and the Hong Kong Computer Emergency Response Team rated the risk as medium on November 6.
The exposure surface is large. Security firm Detectify has noted that Shodan, the search engine that scans internet-connected devices, lists around 22 million systems with SSH open on port 22. Only a fraction run the vulnerable combination, but Alpine is the base image for a huge share of Docker containers, which means the vulnerable configuration is far more common in cloud and container infrastructure than most operators realize.
How to Check If Your Servers Are Exposed
The researcher published a check script on GitHub that reports accounts accepting the bypass, and the check itself is straightforward. On each Linux server and container host you manage, confirm:
- Whether the system uses musl libc — Alpine Linux, OpenWrt, Buildroot, and Yocto-based systems are the main candidates.
- Whether sshd runs without PAM. On Alpine, check whether the openssh-server package is the no-PAM build, or whether sshd_config sets UsePAM no.
- Whether password authentication is enabled in sshd_config.
- Whether any account in /etc/shadow has a * password field, and whether another account has a real password hash.
Container images deserve special attention. Scan your Alpine-based images and rebuild any that carry a vulnerable OpenSSH version. Vulnerability scanners read Alpine’s security database, so CVE-2026-123158 should show up against the openssh package as soon as scanner feeds refresh.
How to Fix It: Patch, or Disable Password Login
The fix is simple, and there are two layers to it:
Update OpenSSH. OpenSSH 10.6p2 contains the workaround: sshd now refuses a password match when the stored password field is shorter than four characters, so a * can never match again. On Alpine, the fix arrived as patched openssh packages for every supported branch the same day — for example, 10.3_p1-r2 on Alpine 3.24 and 10.2_p1-r1 on 3.23, with backports down to 3.16. Run apk upgrade openssh and restart sshd.
If you cannot patch yet, turn off password logins. OpenSSH maintainer Damien Miller told operators of affected systems to set PasswordAuthentication no or disable SSH immediately. Key-based authentication is unaffected by the bug and keeps working. Add the setting to a drop-in file, for example: echo “PasswordAuthentication no” > /etc/ssh/sshd_config.d/00-no-passwords.conf — then restart sshd. This is the safer configuration for internet-facing servers in general, and it removes the vulnerable code path entirely.
A Decade-Old Bug With a Modern Lesson
SSHole is a logic bug, not memory corruption, and it survived for about ten years because it sits in the least glamorous corner of the codebase — the password-checking code most researchers skip in favor of cryptography. The researcher notes that nobody at OpenSSH, Alpine, or the musl project had spotted it, and that OpenSSH tests on OpenBSD and glibc while musl does not test sshd — so the one combination that misbehaves was the one nobody exercised.
There is a larger shift behind the speed of the fix. OpenSSH’s release notes say the project has received a large number of security reports recently, many of them findings from AI models or made with AI assistance, and that bugs identified by AI tools have repeatedly been independently discovered by different researchers. The project’s conclusion is blunt: adversaries who do not report bugs are likely to be able to discover these bugs too. So instead of batching fixes into the next planned release, OpenSSH will now release more frequently. The same logic applies to confidential computing more broadly — Google’s new TPU 8tx hardware, built for confidential AI inference shows how seriously the industry now takes protecting data while it is being processed, not just while it is stored or in transit.
For operators, the takeaway is practical rather than philosophical. Inventory your Alpine and musl-based systems, patch OpenSSH or disable password authentication, and treat passwordless * accounts as exactly what they are — accounts that must never accept a password, no matter how long it is.
