OpenSSH flaw lets attackers bypass password checks on Alpine Linux

CVE-2026-123158, nicknamed “*sshole,” concerns an OpenSSH authentication bypass affecting musl-based systems, notably Alpine Linux. StepSecurity states that Özgün Kültekin disclosed the flaw on 5 November 2026, with OpenSSH running on musl Linux accepting logins for accounts whose shadow field is “*” when certain exposure conditions are met.

In their tests, a host could authenticate to an eligible key-only account using an overlong password, under conditions including unpatched sshd, PAM being disabled, PasswordAuthentication set to yes, and at least one local account with a real SHA-crypt hash. Alpine’s default tiny-cloud images include a passwordless alpine user, but exploitation requires at least one local account with a real hash and, for root, PermitRootLogin yes. OpenSSH shipped a fix on the same day in version 10.6p2, with patched Alpine packages on all branches.

StepSecurity describes two lab environments (Alpine 3.24 VM and an Alpine Docker container) using pre-fix OpenSSH 10.3_p1-r1, confirming the boundary conditions and the documented “failed first attempt” and “subsequent success” behaviour. They report that a password longer than 256 bytes, if used as the first attempt, is rejected, but a second or later attempt in the same connection can succeed, resulting in an Accepted password for a passwordless account.

PAM-enabled configurations block the bypass, and the PAM variant remains vulnerable only when PAM is disabled. Upstream fix is OpenSSH 10.6p2 (commit 4353fdc43); Alpine published patched packages for all branches on 5 November 2026. The article provides steps for verification and mitigation, including upgrading OpenSSH and restarting sshd, or using UsePAM yes as a workaround.