OpenSSH '*sshole' flaw opens musl Linux accounts to attackers

A security researcher ran AI agents through roughly 17,600 authentication tests against OpenSSH and found a trivial unlock: on musl-based Linux, a password of at least 256 bytes logs an attacker into accounts that were supposed to be locked out, BleepingComputer reports. The disclosure went public on November 5.

Author Lawrence Abrams opens the piece: "A newly disclosed flaw involving OpenSSH and musl, dubbed '*sshole,' allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password."

The mechanics are narrow. On musl systems, the crypt() function returns the character '*' for any password longer than 256 bytes. Accounts whose stored password-hash field is also '*' (the standard way to disable password login) then match. The bug traces to a 2016 OpenSSH change for CVE-2016-6210 that was modified "to perform password hashing even when an account had no usable password hash." Exploitation needs the full stack: OpenSSH on musl, PAM disabled, SSH password auth on, and at least one account with '*' as its hash alongside another account carrying a real password.

Researcher Ozgun Kultekin flags the practical exposure: Alpine's "official AWS and Azure cloud images have an affected default 'alpine' account." Still, Abrams notes, "The flaw does not allow attackers to bypass passwords on accounts with valid password hashes."

OpenSSH 10.6p2 ships the fix. Operators who can't update immediately can set 'PasswordAuthentication no' in sshd_config or re-enable PAM. The AI-agent methodology is its own signal in a busy cybersecurity week that already included DOJ launching an AI-misuse task force and Anthropic shipping its Claude Security Center.