🔍 Read the full analysis: Some Linux Servers Face Attacks Through An OpenSSH Password Bug on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A flaw in OpenSSH can let attackers log in to certain Linux accounts without knowing the password, but only when several specific system and configuration conditions are met. OpenSSH released a fix on November 5, 2026; public exploit code appeared about four hours later, and the vulnerability was added to CISA’s exploited-vulnerability list on November 9. Administrators should update and restart sshd or disable password authentication while they assess affected systems.
A flaw in OpenSSH can allow an attacker to log in to certain Linux accounts without a valid password, and public exploit code appeared hours after a fix was released. The vulnerability, tracked as CVE-2026-123158 and rated high severity, affects systems meeting a narrow set of conditions, including use of the musl C library and password authentication without PAM.
OpenSSH released version 10.6p2 on November 5 to address the flaw, which its finder calls “sshole.” GreyNoise and BleepingComputer reported that exploit code became public about four hours after the release. GreyNoise said its sensors recorded a first successful break-in roughly 40 hours after the fix was published. CISA added the vulnerability to its catalog of exploited vulnerabilities on November 9.
The bypass depends on how certain software handles an unusually long password. Alpine Linux’s advisory says musl’s crypt() function returns an asterisk when a password exceeds 256 bytes. On affected systems, that error value can match the asterisk stored for an account that has no password, causing the check to succeed. The advisory says the attacker can send a password between 257 and 1,024 bytes.
The issue is limited to systems where sshd runs on Linux with musl, checks passwords without PAM, and has password authentication enabled. An account with an asterisk password field and at least one local account with a qualifying password hash are also required. Alpine’s standard OpenSSH server package is a prominent example. Ubuntu says its builds use glibc and PAM and are not affected; Red Hat also says its products are not affected.
OpenSSH password flaw puts some Linux servers at risk
A narrow combination of system and account settings can let an attacker log in without a valid password. Administrators should identify affected hosts, patch, and restart sshd.
When the flaw can work
The exposure depends on several local settings being present together.
musl on Linux
The affected password check relies on musl’s handling of unusually long passwords.
No PAM, password login on
sshd must check passwords without PAM while password authentication is enabled.
Specific password fields
An asterisk-field account and a local account with a qualifying $5$ or $6$ hash are also required.
How the check is bypassed
An overlong password can produce a value that matches an account field meant to prevent password login.
The attacker sends between 257 and 1,024 bytes to the reachable SSH service.
For input over 256 bytes, musl’s crypt() returns an asterisk.
On qualifying systems, the result can match an asterisk in the account’s password field and allow login.
Check your system’s exposure
The reports identify a limited configuration; they do not establish how many servers are vulnerable.
- Alpine’s standard OpenSSH server package is a prominent example.
- OpenWrt, Buildroot, and Yocto were named; a stock Yocto image was reported vulnerable.
- Ubuntu says its builds use glibc and PAM.
- Red Hat says its products are not affected.
- glibc systems, non-Linux systems, PAM password checks, disabled password authentication, and Dropbear are outside the reported scope.
What administrators should do
Apply the vendor fix and confirm the running SSH service has taken it up.
- Check library, PAM, SSH, account, and password-hash settings.
- Install a fixed OpenSSH package and restart sshd; upgrading alone does not replace a daemon already running in memory.
- If you cannot update promptly, disable password authentication and confirm the running service adopted the change.
- Review SSH logs for password logins to accounts with no password, and assess whether those accounts could gain elevated privileges.
A Narrow Flaw With Real Exposure
The conditions are specific, but the impact for a machine that meets them is direct: an attacker who can reach its SSH service may be able to access an account without knowing its password. Alpine says the bypass needs one connection and no retries. Access to an account that can gain higher privileges could turn a login bypass into a broader system compromise.
The rapid sequence from patch release to public exploit underscores the urgency for administrators of affected systems. GreyNoise’s reported observation of a successful break-in and CISA’s listing establish that exploitation has been reported, but they do not show how widespread attacks are. The practical priority is to identify systems using the affected combination, apply the package fix, and restart the running SSH daemon.
The episode also highlights how a failure at the boundary between OpenSSH and a C library can create a security issue even when the underlying components disagree about where responsibility lies. OpenSSH says the root cause is outside sshd but can be avoided there. Musl maintainer Rich Felker has said he views the behavior as an erroneous use by the caller, while indicating the mechanism may change in a future release cycle.
Popular right now
Ninja CREAMi 7-in-1 Ice Cream Maker, NC299AMZ
Shark ZU102 Rotator Pet Upright Vacuum with PowerFins HairPro & Odor Neutralizer Technology, Charcoal
Samsung 43-Inch M70H Series 4K Mini LED Smart TV (2026)
As an affiliate, we earn on qualifying purchases.
How the Password Check Failed
On Linux, an account that is not meant to authenticate with a password may have an asterisk in its password field. Under ordinary circumstances, that value cannot be matched by a real password. The failure here occurs when sshd checks a password without PAM and calls musl’s crypt() function: for an overlong input, the function returns the same asterisk used in the account field. The matching value can then be mistaken for a valid result.
Alpine’s advisory lists several ways an asterisk-field account may be present, including key-only users, some directory-service accounts, and the root account on Alpine installations. It also says the system must have at least one local account with a $5$ or $6$ password hash. Root’s usual OpenSSH protection does not necessarily eliminate the risk if another accessible account can become root.
The reported scope excludes Linux systems using glibc, non-Linux systems, systems that use PAM for password checks, and systems with password authentication disabled. The source material also identifies Dropbear as unaffected. Alpine has published fixed packages for its supported branches and backported fixes to older branches, while Debian’s tracker lists the fixed upstream version in its unstable branch.
“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”
— Alpine Linux security advisory
Exposure Depends on Local Configuration
The total number of vulnerable servers and the scale of successful attacks have not been established in the supplied reports. GreyNoise reported a successful break-in on one of its sensors, but that observation does not quantify the broader impact. It is also not clear how many systems in embedded environments use the affected combination.
Alpine is the best-known affected case, while the researcher also named OpenWrt, Buildroot, and Yocto. However, Medcrypt reported reproducing the issue on a stock Yocto image, a finding that points to potential exposure beyond Alpine but does not establish that every Yocto deployment is vulnerable. Administrators must check their own library, PAM, SSH, account, and password-hash configuration.
Responsibility for the underlying behavior remains disputed between OpenSSH and musl’s maintainer. That disagreement does not change the availability of OpenSSH’s mitigation, but the source material does not specify when or how broadly musl will alter its behavior.
Patch, Restart, and Check Logs
Administrators should install a fixed OpenSSH package and restart sshd; Alpine warns that upgrading the package alone does not replace a daemon already running in memory. Where an update cannot be applied promptly, the stated mitigation is to set PasswordAuthentication no and confirm that the running service has adopted the change.
Operators should also review SSH authentication logs for password logins to accounts that have no password, then assess whether any affected account could gain elevated privileges. Alpine’s instructions include upgrading packages across its branches, including older releases, but package names and update commands depend on the distribution and release in use.
Further advisories or package updates may clarify exposure in embedded Linux products and whether musl changes its error-handling mechanism. Until then, the immediate next step for administrators is to verify whether all conditions apply to their systems and apply the vendor’s fix or mitigation.
Key Questions
Which Linux servers are affected?
Only systems meeting several conditions are affected: Linux with musl, OpenSSH checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and at least one local account with a qualifying $5$ or $6$ hash. Alpine Linux is a known example.
Are Ubuntu and Red Hat systems affected?
Ubuntu says its OpenSSH builds use glibc and PAM and are not affected. Red Hat says its products are not affected. Administrators should still follow their distribution’s security notices for the exact systems and packages they run.
What should administrators do now?
Install the fixed OpenSSH package and restart sshd. If an update is not immediately possible, disable password authentication with PasswordAuthentication no. Review logs for password logins to accounts that have no password.
Does this flaw affect every account on an affected server?
No. The reported bypass concerns accounts with an asterisk in the password field, and it requires other system conditions, including a qualifying local password hash. The actual exposure depends on the server’s configuration and account setup.
Has the flaw been exploited?
GreyNoise reported seeing a successful break-in on one of its sensors about 40 hours after the fix was released. CISA added the flaw to its exploited-vulnerability list on November 9. Those reports confirm observed exploitation but do not establish how widespread it is.
Source: ThorstenMeyerAI.com
