- A critical vulnerability (*sshole) in OpenSSH and musl libc allows attackers to bypass authentication on Linux systems.
- Exploitation occurs by entering a password between 257 and 1,024 characters for accounts configured without a password.
- Affected systems include those running musl libc (e.g., Alpine Linux), OpenSSH without PAM, and with password authentication enabled.
Critical Flaw in OpenSSH and musl libc: Authentication Bypass Impacts Alpine Linux
A recently disclosed security vulnerability, dubbed *sshole (or SSHole) and tracked as CVE-2026-123158 with a CVSS score of 8.1, enables attackers to bypass authentication on certain Linux systems. This flaw affects the interaction between OpenSSH and musl libc, a lightweight C library commonly used in distributions like Alpine Linux. Exploitation is possible under specific conditions, including OpenSSH running without Pluggable Authentication Modules (PAM) and with password authentication enabled.
Attack Mechanism and Exploitation Conditions
The vulnerability arises when musl’s crypt() function returns an asterisk (*) instead of a null value as an error condition when it fails to compute a password hash. OpenSSH then mistakenly interprets this asterisk as a valid hash for accounts that are not supposed to have passwords (marked with * in the password field of /etc/shadow). An overly long password input, specifically between 257 and 1,024 characters, triggers this chain of mistakes, allowing access to accounts typically used for key-based authentication, such as root, key-only deployment users, and LDAP users.
| Condition | Description |
|---|---|
| C Library | musl libc (instead of GNU C library) |
| SSH Service | OpenSSH (versions prior to 10.6p2) |
| Authentication | Password authentication enabled |
| PAM Modules | PAM disabled |
| Target Accounts | Marked with “*” in password field (e.g., root, key-only) |
| Additional Condition | At least one other account with a valid SHA-256/512 hash |
| Password Length | Between 257 and 1,024 characters |
Affected Systems and Mitigation Strategies
Alpine Linux is a primary concern due to its widespread use in Docker/open-source container orchestration system for automating software deployment, scaling, and management.">Kubernetes/Proxmox containers, cloud VMs, and embedded devices. Buildroot, Yocto, and Void Linux may also be affected. OpenWRT, while defaulting to Dropbear, is vulnerable if users have installed OpenSSH instead.
OpenSSH has promptly released a fix in version 10.6p2. All administrators are strongly advised to update their systems immediately. As a temporary mitigation, explicitly setting PasswordAuthentication no in the OpenSSH configuration file and restarting the service can secure vulnerable systems. While most Alpine installations are not directly internet-facing, any attacker within a network, such as corporate setups, home labs, or cloud environments, can exploit this flaw.
For more insights into cybersecurity and recent vulnerabilities, you can explore other PROSTO24 articles.
For system administrators and developers utilizing Alpine Linux or other musl libc-based distributions with OpenSSH, immediate action is paramount. Updating to OpenSSH 10.6p2 or disabling password authentication is crucial. This vulnerability underscores the importance of regular security configuration audits, especially in environments leveraging lightweight libraries and specialized settings. Failure to address this flaw promptly could lead to unauthorized access to critical systems.
This *sshole flaw is a real headache for anyone running Alpine in containers, especially in CI/CD pipelines. I’ve been using Alpine extensively for lightweight images, and while disabling password auth is standard practice, it’s easy to overlook in some legacy setups or quick dev environments. The fix in OpenSSH 10.6p2 is crucial. My tip: always audit your /etc/shadow for any unexpected asterisks, and enforce key-only authentication across the board with strict policies. It’s a good reminder that even ‘minimal’ can have hidden gotchas.