🔍 Read the full analysis: Are Attackers Using The OpenSSH SSHole Bug? What Linux Admins Should Know on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
GreyNoise reported a successful attack against one of its sensors about 40 hours after OpenSSH released a fix for CVE-2026-123158, known as SSHole. The flaw affects a narrow set of Linux systems running OpenSSH with musl, without PAM, and with password authentication enabled. Administrators should update to a fixed package, restart sshd, or disable password authentication until they can patch.
GreyNoise recorded a successful break-in using the OpenSSH flaw known as SSHole about 40 hours after a fix was released, according to source material published Nov. 11. Tracked as CVE-2026-123158 and rated High at 8.1, the bug can allow passwordless access under a specific set of Linux configurations, making it urgent for affected administrators to patch or disable password logins.
OpenSSH released version 10.6p2 on Nov. 5, and public exploit code appeared about four hours later, according to GreyNoise and BleepingComputer. GreyNoise said its sensor recorded the first successful break-in it observed about 40 hours after the release. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its list of exploited vulnerabilities on Nov. 9. These reports establish observed exploitation, but do not show how broadly the flaw has been used.
The issue does not affect every OpenSSH server. According to Alpine Linux’s advisory, exploitation requires a Linux system using musl libc, an sshd setup that checks passwords without PAM, password authentication enabled, an account whose password field contains an asterisk, and at least one local account with a $5$ or $6$ password hash. Alpine’s standard openssh-server package is a prominent affected configuration. The source material says Debian, Ubuntu and Red Hat report that their builds or products are not affected.
For affected machines, the recommended action is to install a fixed OpenSSH package and restart sshd. Alpine says fixed packages are available for its branches, including older releases listed in its advisory. If an update is not immediately possible, administrators can set PasswordAuthentication no. They should also review authentication logs for password logins to accounts that should not accept passwords. Installing a package without restarting the running daemon may leave the vulnerable process in memory, Alpine warns.
Are Attackers Using the OpenSSH SSHole Bug? What Linux Admins Should Know
GreyNoise observed a successful attack on one sensor about 40 hours after a fix was released. The risk applies only to systems meeting a specific set of Linux and OpenSSH conditions.
When the flaw can apply
Check the full configuration; no single condition establishes exposure.
Linux with musl
The described attack requires musl libc and an sshd password check that does not use PAM.
Password login enabled
An account must have an asterisk in its password field, and a local account must have a $5$ or $6$ hash.
Verify each image
Alpine’s standard package is a prominent affected configuration. Reports also describe a stock Yocto image; that does not establish that every Yocto image is vulnerable.
What the reports establish
The timeline shows observed exploitation, but not how widespread it is.
Why the password check fails
In the affected setup, a long password can make musl’s crypt() return an asterisk error value that matches an account’s stored asterisk field.
Without PAM, the supplied text is hashed with crypt() and compared with the stored field.
For input longer than 256 bytes, musl crypt() returns an asterisk error indicator, according to Alpine.
The matching value can allow passwordless access in the qualifying configuration, with one connection and no repeated guesses.
What administrators should do
Update the package and make sure the running daemon uses it.
- Check for musl, PAM use, password authentication settings, account fields, and qualifying password hashes.
- On affected systems, install OpenSSH 10.6p2 or the distributor’s fixed package, then restart sshd.
- If you cannot patch promptly, set PasswordAuthentication no and confirm the setting is active.
- Review authentication logs for unexpected successful password logins to accounts with an asterisk password field.
Why the Narrow Bug Still Matters
SSH is a common way for administrators and automated systems to access servers remotely. On a machine meeting the required conditions, the flaw can turn an account intended to be inaccessible by password into an entry point. The risk is especially relevant to small, embedded and appliance-style Linux builds, where musl is used and package configurations may differ from those in major desktop and server distributions.
The reported sensor activity also shows why a patch window can matter. Public exploit code appeared within hours of the fix, and GreyNoise reported a successful attack on a sensor roughly 40 hours after release. That timeline does not establish widespread compromise, but it gives operators reason to check exposure promptly rather than assume the narrow scope makes the issue irrelevant.
Alpine has warned that a locked account alone may not end the risk if another account can log in and gain elevated privileges. Its official tiny-cloud images in versions 3.18.11 through 3.24.3 include an alpine account with an asterisk password field and passwordless doas, according to the advisory. Those images become exploitable once a qualifying $6$ hash exists on the system. Administrators should check the full configuration, not only whether root can log in directly.
Products Worth Considering
Philips Hue Festavia Outdoor Globe String Lights, 8 Bulbs, 22 ft
Levoit Core 600S-P Smart Air Purifier for Large Rooms
Hisense E6SR Series 55-Inch 4K UHD Hi-QLED Roku Smart TV
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
The reported failure involves OpenSSH, musl’s crypt() function and a stored asterisk. On some systems, accounts that should not be usable for password login have an asterisk in the password field. Alpine explains that when sshd checks a password without PAM, it hashes the supplied text using crypt() and compares the result with that stored field.
With an input longer than 256 bytes, musl’s crypt() returns an asterisk as an error indicator, according to Alpine. That error value matches the stored field for an account without a password. A sufficiently long password—between 257 and 1,024 bytes in the source material—can therefore cause the comparison to succeed in the affected setup. Alpine says the attack can take one connection and does not require repeated guesses.
There is a dispute over where the underlying fault belongs. OpenSSH says the root cause is outside sshd, though it can be avoided there. Musl maintainer Rich Felker has said the library behavior is not itself a bug and characterized the problem as an erroneous use by the caller; he also indicated musl may change the mechanism in a future release cycle. The OpenSSH update is available regardless of that disagreement.
Systems using glibc, PAM-based password checks, or password authentication turned off are not among the affected configurations described in the advisories. The source also identifies non-Linux systems, Dropbear, and containers that do not run sshd internally as outside the reported exposure. Ubuntu says its OpenSSH is linked against glibc and uses PAM; Red Hat says its products are not affected. Debian lists the issue as unimportant for its packages.
“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”
— Alpine Linux advisory
Scope of Attacks Remains Unknown
The full extent of exploitation is not known from the reports cited. GreyNoise described a successful attack on one sensor, but the material does not specify the attacker, the targeted account, whether data was accessed, or whether other victims have been confirmed. CISA’s listing indicates the flaw is considered exploited; it does not, by itself, quantify incidents or identify affected organizations.
Exposure is also not settled across all embedded Linux deployments. The researcher named OpenWrt, Buildroot and Yocto as environments to consider, while the source material says Medcrypt reported reproducing the issue on a stock Yocto image. That report is a specific finding, not evidence that every image built with those systems is vulnerable. Administrators must verify the actual libc, PAM use, sshd settings and account database on their devices.
The source does not give a complete list of affected products or confirm whether every downstream distributor has issued a fix. It also remains unsettled whether musl will change its behavior and how that might affect systems beyond this OpenSSH issue.
Patch, Restart and Check Logs
Administrators should first determine whether their systems use musl and whether all the other listed conditions are present. If affected, they should install OpenSSH 10.6p2 or the distributor’s fixed package, then restart the SSH daemon so the updated code is running. Alpine’s advisory provides fixed packages for its listed branches, including older releases.
Where a patch cannot be applied promptly, administrators should disable password authentication and confirm the setting is active. They should inspect SSH logs for successful password logins to accounts with an asterisk password field, then investigate any unexpected access and rotate credentials or take other response steps under their incident procedures. A check of cloud images and embedded builds is warranted where administrators do not control the original package configuration.
Further guidance may come from Linux distributors, embedded-platform maintainers and musl as they publish package updates or clarify affected builds. For now, the immediate next step is local verification: the vulnerability is configuration-dependent, and the source reports do not establish that every Linux server—or every musl-based device—is exposed.
Key Questions
What is the OpenSSH SSHole vulnerability?
SSHole is CVE-2026-123158, a password-checking flaw that can permit access to certain accounts when OpenSSH runs on Linux with musl, checks passwords without PAM, and uses password authentication. The issue depends on additional account and password-hash conditions.
Are Debian, Ubuntu and Red Hat systems affected?
The source material says Ubuntu and Red Hat report their products are not affected, and Debian rates the issue unimportant for its packages. Ubuntu cites its use of glibc and PAM. Administrators should still follow their distributor’s advisories for the specific release they operate.
What should Linux administrators do now?
Install a fixed OpenSSH package and restart sshd. If that is not possible immediately, disable password authentication and review logs for unexpected password logins to accounts that should not accept passwords.
Does the reported exploitation mean my server was compromised?
No. GreyNoise reported a successful attack on one of its sensors, but that does not establish that a particular server was targeted or compromised. Exposure depends on the machine’s configuration; check the relevant conditions and investigate any suspicious authentication records.
Source: ThorstenMeyerAI.com
