Decade-Old ‘SSHole’ Flaw Lets Hackers Log Into Linux Without a Password
A bug in OpenSSH on musl-based Linux systems such as Alpine lets attackers in with an overlong password. One security firm says attacks began within hours.
A security flaw that has sat unnoticed for about a decade can let attackers log into some Linux servers over SSH without knowing the password, and at least one threat intelligence firm says hackers began trying it within hours of its public disclosure. The bug, nicknamed “*SSHole” and tracked as CVE-2026-123158, affects OpenSSH, the widely used software for logging into remote machines, on systems built with the lightweight musl C library. The most prominent of these is Alpine Linux, a small distribution that is common in containers, cloud images and network devices.
OpenSSH released an emergency update, version 10.6p2, on November 5, and Alpine Linux pushed patched packages the same day, according to Techzine and CSO Online. The U.S. National Vulnerability Database rates the flaw 8.1 out of 10, or “high” severity, while the OpenSSH project itself described the issue as critical, Cyber Daily reported.
How the attack works
The flaw was discovered by Özgün Kültekin, a researcher at the security testing firm Wakefield, CSO Online reported. It comes from an unexpected interaction between three separate design choices made years apart, rather than a single coding mistake.
Some accounts on a Linux system are deliberately set up so that no password can unlock them. Their password field holds a single asterisk, a long-standing convention meaning “no valid password.” On Alpine, the root account is configured this way so administrators can still log in with cryptographic keys instead.
According to CSO Online, musl began capping passwords at 256 bytes in 2012, and its password-hashing function returns an asterisk when it fails. In 2016, OpenSSH changed how it handles accounts without a password salt, a defense against attackers guessing which usernames exist. The combination means that when someone submits a very long password for a locked account, the hashing step fails, produces an asterisk, and that asterisk matches the one stored for the account. The login succeeds.
“On affected servers, they accepted any password between 257 and 1,024 characters long,” Kültekin said, as quoted by Cyber Daily. Techzine reported that a single connection is enough, with no need for repeated guessing.
The attack only works under specific conditions. According to the outlets, all of the following must be true:
- The system uses musl rather than glibc, the C library used by mainstream distributions such as Debian, Ubuntu and Fedora, which are not affected.
- It runs OpenSSH, not alternatives such as Dropbear, and OpenSSH is built without PAM, a common Linux authentication framework.
- Password logins over SSH are enabled.
- The attacker knows the name of a password-locked account, and at least one other account on the machine has a real password.
Alpine’s default configuration meets these conditions. CSO Online reported that Alpine’s official cloud images from versions 3.18.11 through 3.24.3 are exposed through a default account named “alpine,” which has passwordless administrator privileges. Jake Knott, head of threat intelligence at the security firm watchTowr, told reporters that this default user on Alpine’s Amazon Web Services and Microsoft Azure images is a likely target. Researchers at Check Point also confirmed the issue and warned that attackers who reach accounts with elevated permissions could take over a machine, Techzine reported.
Conflicting reports on exploitation
Accounts differ on how quickly attackers moved. A November 6 threat brief published by Carthage Electronics, citing the threat intelligence firm Previdian, said exploitation attempts began less than nine hours after the vulnerability was disclosed, with roughly eight attempts from an internet address in Japan, and that Previdian confirmed an attacker gained root access on an Alpine “honeypot,” a decoy server set up to attract attackers. Ars Technica has also described the flaw as under active exploitation.
Other early reports were more cautious. CSO Online did not report confirmed attacks in the wild, though Knott said he expected automated SSH password-guessing tools to add the technique soon. As of November 6, the flaw had not been added to the Known Exploited Vulnerabilities catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), according to the Carthage brief. No outlet reviewed gave a count of how many servers are exposed.
Why it matters and what comes next
Alpine’s small size has made it a favorite base for software containers and embedded hardware such as routers and industrial controllers, Techzine noted, and many such devices are difficult to update. That raises the risk that vulnerable systems will remain online long after patches are available.
The OpenSSH maintainers dispute that the root cause lies in their code but chose to fix it there because their software is where it can be exploited, according to Cyber Daily. Damien Miller, an OpenSSH maintainer, urged administrators of affected systems to “set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY” if they cannot update.
Alpine has advised administrators to install the fixes and restart the SSH service, since upgrading the package alone does not restart it, and to review logs for successful password logins to accounts that should not accept them, CSO Online and the Carthage brief reported. Alpine also said any exposed server where an unauthorized login cannot be ruled out should be treated as compromised. Kültekin has published a script on GitHub that checks whether a server is exposed and lists at-risk accounts.
