Technology and Scienceupdated 35m ago2 min read
OpenSSH Emergency Fixes *sshole Flaw Letting Attackers Bypass Password Authentication on Alpine Linux
12outlets comparedA wider view of the story
9 Other2 Western Mainstream1 Local WesternThis article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
Oversized passwords (257–1,024 chars) bypass password authentication on musl-based Linux, including Alpine. Emergency fix Portable OpenSSH 10.6p2 released Nov 5, 2026 to block bypass on musl systems.
Save coverage image
12 outlets in this story. Read their headlines below.
The SSHhole bypass
OpenSSH 10.6p2 addressed a vulnerability that lets attackers log into some Linux devices without a password when OpenSSH runs on musl-based systems without PAM and when a passwordless account is represented by an asterisk (*) in /etc/shadow. "An attacker who can reach your SSH port can log in without knowing any password," and it added that "It takes one connection, works every time, and needs no retries." The flaw is described as "*sshole," saying attackers can log in to certain Alpine Linux and other musl-based accounts configured to block password authentication by entering an oversized password.
musl’s crypt() returns * when password hashing fails, including when a submitted password exceeds its 256-byte limit, and OpenSSH can then compare that returned * against the account’s stored * to succeed. The attacker can gain access by inputting more than 256 characters in the password field when logging into a passwordless account, and Checkpoint warned that the use of SHA256 or SHA512 "matters because sshd borrows that account’s salt."
Conditions and discovery
Özgün Kültekin, described by BleepingComputer as the researcher who discovered and released details on the vulnerability, said the flaw has existed since 2016 and stems from how OpenSSH handles password verification errors on systems using the musl C library. exploitation requires PAM to be disabled, SSH password authentication to be enabled, at least one account to have an asterisk (*) as its password hash, and another account to have a valid password hash. Alpine Linux’s official AWS and Azure cloud images have an affected default 'alpine' account with passwordless 'doas' privileges, which could allow attackers to gain root access.
Checkpoint reported that root accounts are safe under the default PermitRootLogin prohibit password setting, while it said reachable accounts with doas or sudo rights can still become root. Kultekin discovered the vulnerability using AI agents that ran about 17,600 authentication tests with different OpenSSH configurations, malformed password hashes, and oversized passwords.
Fixes and operational steps
OpenSSH released Portable 10.6p2 on November 5, 2026, and Damien Miller urged operators of affected musl-based Linux systems to disable password authentication or disable SSH immediately, according to The Hacker News. "set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY." Alpine advised administrators to update their OpenSSH packages using apk upgrade openssh, and the vulnerability has been fixed in OpenSSH 10.6p2.
administrators who cannot immediately install the update can mitigate the issue by turning off SSH password authentication with PasswordAuthentication no in their SSH server configuration and restarting SSH. administrators can check for signs of exploitation by examining SSH authentication logs for password-based logins for accounts that should not allow them, including using grep "Accepted password" /var/log/messages on Alpine Linux.