CVE-2026-123158, OpenSSH Portable before 10.6p2 (*sshole): on Linux with musl libc and no PAM, a password of 257 to 1,024 bytes logs in to accounts whose password field is *; NCSC Switzerland issued an advisory (CVSS 3.1 8.1)
OpenSSH 10.6p2: password bypass on musl Linux without PAM (Alpine, OpenWrt); update or turn passwords off
Defender actions
- On every musl-based Linux host that runs sshd (Alpine, OpenWrt, Buildroot, Yocto), install OpenSSH 10.6p2 or the distribution's fixed openssh package and restart sshd, because updating the package does not replace the running server, and rebuild container and cloud images from a fixed base; until then set PasswordAuthentication no in sshd_config and restart sshd.
Analysis
Portable OpenSSH 10.6p2, released on 2026-11-05, carries what its release notes call a critical security workaround for Linux systems that use the musl libc with PAM disabled (OpenSSH, 2026-11-05). NCSC Switzerland says remote, unauthenticated attackers can bypass SSH password authentication over the network and gain access, and rates the exploitation status unknown (NCSC Switzerland, 2026-11-05). OX Security explains the mechanism: musl's crypt() refuses inputs over 256 bytes and returns the string * when it fails, * is also what /etc/shadow holds for an account with no valid password, and OpenSSH, whose 2016 user-enumeration countermeasure can hash a password with settings taken from another account, reads the two matching values as a successful login (OX Security, 2026-11-05). OX gives the conditions: sshd on musl without PAM (Alpine's openssh-server by default, or UsePAM no), password logins enabled, an account whose password field is * (key-only users, LDAP users, root on Alpine) and at least one other account on the host with a real password; accounts that hold !, glibc systems, PAM setups, Dropbear and OpenBSD are not affected, and OX scores the flaw CVSS 3.1 8.1 (OX Security, 2026-11-05). On Alpine's official AWS and Azure images the passwordless account is the default alpine user, which can run doas without a password, so the bypass chains to root there (OX Security, 2026-11-05).
The OpenSSH developers do not consider the root cause to lie in OpenSSH (heise online, 2026-11-05), and NCSC Switzerland adds that other software using similar authentication paths may be affected (NCSC Switzerland, 2026-11-05). Alpine pushed the fix to every branch back to 3.16 (edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7, 3.16 9.0_p1-r6) (OX Security, 2026-11-05); on release day other distributions and many OpenSSH download servers still offered 10.6p1 (heise online, 2026-11-05).
Triage: an accepted password login is normal for an account with a real hash; the same event for an account whose password field is * has no benign explanation, because such an account cannot match any password.
Cited evidence
Successful exploitation allows remote, unauthenticated attackers to bypass SSH password authentication over the network and gain unauthorized system access.
This release contains a critical security workaround that affects
The vulnerability allows an attacker to authenticate to certain password-disabled accounts using an arbitrary password between 257 and 1,024 bytes long.
Sources4
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.