OpenSSH patches SSHole flaw that bypasses password authentication

OpenSSH has issued emergency patches for a high‑severity authentication bypass, known as SSHole (CVE-2026-123158, CVSS 8.1), which affects the OpenSSH server (sshd) on Linux distributions that use the musl libc implementation with PAM disabled.

The flaw arises from a misinterpretation of whether a string is intended to be a password hash, allowing attackers to log in to certain accounts using any password whose length falls between 257 and 1,024 characters. Özgün Kültekin, a Wakefield security researcher, notes that some systems, such as Alpine Linux, OpenWrt, Buildroot and Yocto, permit such access even for root where a password would normally be disallowed. Damien Miller, an OpenSSH developer, says the flaw is exploitable via sshd, though not in sshd itself.

OpenSSH 10.6p2 contains the fixes. Alpine Linux urged users to apply the patches and restart sshd, or disable password logins temporarily. The advisory explains that an attacker needs the name of an account whose password field is “*” (indicating no password for key‑only accounts) and a machine with at least one other account whose password hash uses either SHA‑256 or SHA‑512 (indicated by $5$ or $6$).

Alpine says affected releases include every Alpine version checked, from 3.16 through 3.24 and edge, plus older releases no longer receiving updates (3.16–3.20). Detectify’s Fredrik Almroth cautions that tens of millions of systems are exposed on SSH port 22 and that brute forcing could begin within hours; others, such as WatchTower’s Jake Knott, advise updating to the latest version where possible and temporarily disabling password authentication if feasible. The article notes no exploitation reports at the time, but stresses the vulnerability’s public details and straightforward exploitation path.