● Covered by 7 sources · 8 reportsHigh impact6 negative2 neutral
OpenSSH Flaw Allows Passwordless Login on Alpine Linux and Other musl-based Systems
Key points
- Attackers can log in to passwordless accounts on affected systems.
- The flaw requires a long password (257-1024 bytes) and a specific system configuration.
- Affects OpenSSH on musl-based Linux distributions like Alpine Linux and OpenWrt.
- OpenSSH 10.6p2 fixes the vulnerability; Alpine Linux has released updated packages.
- The issue has existed since 2016 and is dubbed "*sshole" by its discoverer.
- The vulnerability requires OpenSSH with musl not to use PAM.
- The vulnerability requires passwordless accounts configured with SHA256/SHA512 hashed passwords.
- The vulnerability is tracked as CVE-2026-123158 with a CVSS score of 8.1.
- The flaw allows attackers to log in to accounts using passwords between 257 and 1,024 characters.
- The vulnerability affects OpenWrt, Buildroot, and Yocto.
- The flaw is not in sshd itself, but can be exploited via sshd.
- The underlying issue dates back to a patch introduced in 2016 to fix CVE-2016-6210.
- The vulnerability is being actively exploited, with attackers gaining root access on honeypots.
- The vulnerability is in the musl C library's crypt() function.
- The crypt() function returns an asterisk for long passwords, matching passwordless accounts.
- The vulnerability requires PasswordAuthentication to be enabled.
Critical Authentication Bypass Discovered
A critical vulnerability has been identified in OpenSSH when deployed on Linux distributions that utilize the musl C library, such as Alpine Linux, OpenWrt, Buildroot, and Yocto. This flaw allows an attacker to bypass password authentication and gain unauthorized access to accounts that are configured without a password, typically used for SSH key-only access.
Conditions for Exploitation
For the vulnerability to be exploitable, several conditions must be met: the system must be running the Alpine openssh-server package (or similar musl-based OpenSSH build) without PAM for password checks, password logins must be enabled, and there must be at least one other account on the machine with a $5$ or $6$ password hash. Attackers need to know the name of a passwordless account and then submit a password between 257 and 1024 bytes long.
Technical Details and Origin
The flaw, dubbed "*sshole" by security researcher Ozgun Kultekin, has existed since 2016. It stems from how OpenSSH handles password verification errors on systems using the musl C library, specifically interacting with a patch introduced in OpenSSH to address a username enumeration vulnerability (CVE-2016-6210). This interaction allows an oversized password to bypass authentication for accounts marked with an asterisk (*) in the /etc/shadow file, which normally prevents password logins.
Affected Systems and Default Configurations
While the vulnerability affects various musl-based distributions, Alpine Linux is highlighted as a significant concern due to its widespread use in Docker/Kubernetes containers, cloud VMs, and embedded devices. Alpine's default configuration often includes the necessary conditions for the exploit, including password authentication enabled by default and the openssh-server package built without PAM. Non-Linux systems and Linux systems built on glibc are not affected.
Mitigation and Updates
OpenSSH has released version 10.6p2 to fix this issue. Alpine Linux has also published fixed packages for all releases back to 3.16. Users are advised to update their openssh-server package immediately and restart the sshd daemon. As an interim measure, disabling password logins by setting `PasswordAuthentication no` in the sshd configuration and restarting sshd will also close the vulnerability. No attacks using this flaw have been reported at the time of disclosure.
Updates
- The vulnerability is in the musl C library's crypt() function.
- The crypt() function returns an asterisk for long passwords, matching passwordless accounts.
- The vulnerability requires PasswordAuthentication to be enabled.
- The vulnerability is tracked as CVE-2026-123158 with a CVSS score of 8.1.
- The flaw allows attackers to log in to accounts using passwords between 257 and 1,024 characters.
- The vulnerability affects OpenWrt, Buildroot, and Yocto.
- The flaw is not in sshd itself, but can be exploited via sshd.
- The underlying issue dates back to a patch introduced in 2016 to fix CVE-2016-6210.
- The vulnerability is being actively exploited, with attackers gaining root access on honeypots.
- The vulnerability requires OpenSSH with musl not to use PAM.
- The vulnerability requires passwordless accounts configured with SHA256/SHA512 hashed passwords.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
A critical authentication bypass vulnerability (CVE-2026-123158) has been discovered in Alpine Linux and other musl-based distributions running OpenSSH without PAM. Attackers can gain unauthorized access to password-disabled or key-only accounts by sending a password between 257 and 1024 bytes long. This flaw stems from the musl C library's crypt() function returning an asterisk for long passwords, which matches the stored password field for accounts without a password.
A recently disclosed OpenSSH vulnerability, CVE-2026-123158 (SSHOle), is being actively exploited, allowing unauthenticated attackers to log into password-less accounts. The flaw affects OpenSSH on musl C library systems with PAM disabled, such as Alpine Linux, and has been used to gain root access on honeypots.
OpenSSH has issued emergency patches for a high-severity authentication bypass, CVE-2026-123158, affecting OpenSSH servers on Linux distributions using musl libc with PAM disabled. This flaw allows attackers to log in to specific accounts using passwords between 257 and 1,024 characters, potentially compromising systems like Alpine Linux where root accounts may be vulnerable.
A decade-old vulnerability in specific configurations of Alpine Linux allows attackers to log into devices via SSH without a password. This vulnerability affects systems using OpenSSH with musl libc, without PAM, and with passwordless accounts configured using SHA256/SHA512 hashed passwords, posing a significant risk to affected systems.
A critical vulnerability combining flaws in OpenSSH and musl libc allows unauthorized access to Alpine Linux and other distributions by entering a password longer than 256 characters. This issue primarily affects systems with empty user passwords, which is a default configuration in many Alpine Linux deployments, including Docker/Kubernetes containers and cloud VMs.
A newly discovered flaw, dubbed "*sshole," in OpenSSH on musl-based Linux distributions allows attackers to log into accounts configured to block password authentication by submitting an oversized password. This vulnerability, present since 2016, affects systems like Alpine Linux and OpenWrt under specific configurations, potentially granting unauthorized access to accounts with disabled password logins.
OpenSSH released version 10.6p2 to fix a critical flaw in Alpine Linux's openssh-server package that allows attackers to bypass SSH authentication. The vulnerability affects systems where password logins are enabled, PAM is not used for password checks, and at least one other account has a password, enabling login to passwordless accounts with a specific long password.
A critical vulnerability in Alpine Linux's OpenSSH-server package allows attackers to log in without a password if certain conditions are met. This bypass affects systems with accounts lacking passwords and at least one account using a $5$ or $6$ password hash. Users are advised to update OpenSSH immediately or disable password authentication.