Security
OpenSSH 'SSHole' flaw lets passwords of 257 to 1,024 characters log into passwordless accounts on musl Linux without PAM; fixed in OpenSSH 10.6p2
A long-standing OpenSSH flaw on musl Linux without PAM, such as default Alpine, lets 257 to 1,024 character passwords into passwordless accounts.
The flaw only applies to a specific setup, not to Linux in general. OpenSSH released Portable OpenSSH 10.6p2 on November 5, 2026 to fix an authentication bypass nicknamed SSHole, tracked as CVE-2026-123158 by some outlets. On Linux systems that use the musl C library and run sshd without PAM, such as Alpine's default OpenSSH package, a password of 257 to 1,024 characters is accepted for accounts that should not accept passwords at all, including root on some systems. The researcher's repository says the behavior dates back to 2016.
The essentials
- Who is affected: sshd built against musl libc and running without PAM, with password authentication enabled, which is the OpenSSH default. Alpine, OpenWrt, Buildroot and Yocto are named in coverage.
- Which accounts: those whose password field is just an asterisk, which includes locked accounts, key-only accounts and root on some systems.
- Why it works: with a password over 256 bytes, musl's hashing function fails and returns an asterisk, which then matches the stored asterisk. A 257 to 1,024 character password therefore passes the check.
- What to do: update to OpenSSH 10.6p2 or your distribution's patched package, or set PasswordAuthentication to no until you can. OpenSSH developer Damien Miller urged affected operators to act immediately.
How old is the bug?
The researcher, Özgün Kültekin of Wakefield, says in his repository that it has existed since 2016, and that the oldest version he tested, OpenSSH 7.5p1 on musl 1.1.16 from 2017, was also affected. iTnews notes the irony that a fix for a timing flaw with long passwords set up this bypass. Treat the exact start date as the researcher's finding.
Is it a CVE and how severe?
SecurityWeek and IONIX report CVE-2026-123158 with a CVSS 3.1 score of 8.1, while Orca Security described it as having no CVE assigned yet at the time it published. We did not reconcile the two. Miller also said the flaw is not in sshd itself but can be exploited through it; the 10.6p2 fix rejects stored password hashes shorter than four characters.
What is not established
- Whether any attacks have used the flaw in the wild: not reported in the coverage we saw.
- The exact lower bound: most reports say 257 bytes; some say 256.
- Whether distributions beyond those named are affected: depends on musl without PAM and password authentication enabled.
- Whether all vendors have shipped patches: check your distribution.
Summary table
| Point | What is stated as of November 7, 2026 | Source |
|---|---|---|
| Fixed in | Portable OpenSSH 10.6p2, November 5, 2026 | IONIX |
| Identifier | CVE-2026-123158, CVSS 8.1, per SecurityWeek and IONIX | SecurityWeek |
| Trigger | Password of 257 to 1,024 bytes on an account whose password field is an asterisk | iTnews |
| Conditions | musl libc, sshd without PAM, password authentication enabled | IONIX |
| Workaround | PasswordAuthentication no until patched | GitHub (oz9un/sshole) |
FAQ
Are all Linux servers affected?
No. Coverage says it needs musl libc, sshd without PAM and password authentication on; most mainstream distributions use glibc.
Does key-only login protect me?
Disabling password authentication closes the path; the fix is still to update.
Is a patch available?
Yes, Portable OpenSSH 10.6p2; check your distribution for its patched package.
Method and limits
Sources checked on November 7, 2026. We read SecurityWeek, iTnews, the researcher's GitHub repository and IONIX as returned in search results; we did not test the flaw. This is not security advice for your systems; follow your vendor's guidance.
Sources
- SecurityWeek: OpenSSH Rushes Patches for 'SSHole' Authentication Bypass (verified 2026-11-07)
- iTnews: Lightweight Linux distros vulnerable to *sshole password bypass (verified 2026-11-07)
- GitHub (oz9un/sshole): openssh on musl accepted any 257+ char password for accounts with no password (verified 2026-11-07)
- IONIX: SSHhole (CVE-2026-123158) and how IONIX is helping you respond (verified 2026-11-07)
Spotted an error in this article? Report it · Our corrections policy
