OpenSSH has rolled out emergency patches for a high-severity authentication bypass that allows attackers to log in using very long passwords.
Dubbed SSHole and tracked as CVE-2026-123158 (CVSS score of 8.1), the security defect affects the OpenSSH server (sshd) on Linux distributions that use the musl libc implementation with the Pluggable Authentication Module (PAM) disabled.
A “misinterpretation of whether a string is intended to be a password hash” allows attackers to access certain accounts using any password that has between 257 and 1,024 characters.
Some accounts, such as root, should never accept a password, but in Linux distributions such as Alpine, OpenWrt, Buildroot, Yocto, and others, they do, Wakefield security researcher Özgün Kültekin says.
According to OpenSSH developer Damien Miller, the flaw is not in sshd itself, but can be exploited via sshd. Fixes were included in OpenSSH 10.6p2.
“We are making this release as fast as possible (we learned of the problem yesterday) because we have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers,” Miller said.
On Thursday, Alpine Linux urged users to immediately apply the OpenSSH patches and restart sshd to replace the running daemon, or disable password logins and restart sshd.
“The attacker needs the name of an account whose password field is * (an account with no password set, which is normal for key-only accounts), and needs the machine to have at least one other account with a $5$ or $6$ password hash,” Alpine Linux warns.
Since version 3.16, Alpine Linux uses “*” to secure the root account, and $5$ or $6$ in password hashes show whether the SHA-256 or SHA-512 crypt was used.
“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries,” Alpine Linux notes.
Affected Alpine Linux deployments run OpenSSH without PAM, have password authentication enabled, have an account with the password field “*” (such as root, a key-only user created with adduser without a password, the alpine user in the official tiny-cloud images, or a user coming from a directory service through musl-nscd), and have at least one local account with a $5$ or $6$ password hash.
“Affected releases: every Alpine release we checked, 3.21 through 3.24 and edge, and the older releases that no longer receive regular updates (3.16 to 3.20),” Alpine Linux says.
“We haven’t seen any reports of exploitation yet, but the details are public, and the attack is simple, so I expect scanning to start within hours. Finding targets is very easy. Shodan lists around 22 million systems with SSH open on port 22, and the real number is higher because Shodan doesn’t see everything. Only some of those run Alpine, but each attempt is a single connection, so an attacker can afford to try all of them,” Detectify co-founder and principal security researcher Fredrik Almroth said.
“We’d be extremely surprised if we didn’t see SSH brute-forcers attempting this by the weekend. It’s virtually free to try and an easy win if it works. If your organization is affected, update to the latest version where possible, and disable password-based authentication as a temporary mitigation if you can’t,” WatchTowr head of threat intelligence Jake Knott said.
Related: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Related: OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years
Related: Cisco, WatchGuard Release Patches; SonicWall Won’t Fix GMS Flaws
Related: Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day
