OpenSSH sshole Flaw Allows Login to Passwordless Accounts
Original title: OpenSSH sshole Flaw Allows Hackers to Log Into Password-Disabled Linux Accounts Using 257-Character Passwords
OpenSSH sshole flaw lets attackers log into password-disabled accounts using 257-1024 character passwords on musl-based systems.
A decade-old flaw in musl-based OpenSSH allows logins to accounts with password fields set to asterisk. The bypass works with unusually long passwords. The OpenSSH team released version 10.6p2 on November 5, 2026 to address it.
- Affects Alpine Linux, OpenWrt, Buildroot, Yocto
- Requires musl without PAM
- PasswordAuthentication enabled
- Affects accounts with * in password field
- No exploitation reported in the wild
Impact: unauthorized access to passwordless accounts
- 1.upgrade to OpenSSH 10.6p2
- 2.disable PasswordAuthentication
- 3.restart sshd
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |
From the original article
3 min read at gbhackers.com
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that should never accept a password. The flaw, dubbed *sshole, is tracked as CVE-2026-123158. Any password between 257 and 1,024 characters works.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.