OpenSSH '*sshole' flaw opens musl Linux accounts to attackers
TL;DR
- CVE-2026-123158 carries a CVSS 8.1 score; passwords between 257 and 1,024 bytes bypass the lock, while shorter or longer strings are rejected.
- The flaw traces to 2016 and required three independently sound design decisions in musl, OpenSSH, and Linux account management to collide simultaneously.
- AI-driven testing ran approximately 17,600 unusual login combinations to isolate the flaw, surfacing an edge-case interaction that decade-long human audits missed.
A security researcher ran AI agents through roughly 17,600 authentication tests against OpenSSH and found a trivial unlock: on musl-based Linux, a password of at least 256 bytes logs an attacker into accounts that were supposed to be locked out, BleepingComputer reports. The disclosure went public on November 5.
Author Lawrence Abrams opens the piece: "A newly disclosed flaw involving OpenSSH and musl, dubbed '*sshole,' allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password."
The mechanics are narrow. On musl systems, the crypt() function returns the character '*' for any password longer than 256 bytes. Accounts whose stored password-hash field is also '*' (the standard way to disable password login) then match. The bug traces to a 2016 OpenSSH change for CVE-2016-6210 that was modified "to perform password hashing even when an account had no usable password hash." Exploitation needs the full stack: OpenSSH on musl, PAM disabled, SSH password auth on, and at least one account with '*' as its hash alongside another account carrying a real password.
Researcher Ozgun Kultekin flags the practical exposure: Alpine's "official AWS and Azure cloud images have an affected default 'alpine' account." Still, Abrams notes, "The flaw does not allow attackers to bypass passwords on accounts with valid password hashes."
OpenSSH 10.6p2 ships the fix. Operators who can't update immediately can set 'PasswordAuthentication no' in sshd_config or re-enable PAM. The AI-agent methodology is its own signal in a busy cybersecurity week that already included DOJ launching an AI-misuse task force and Anthropic shipping its Claude Security Center.
What others are reporting
-
Tom's Hardware Read →
Established tech media emphasizing dual emergency patches for both OpenSSH and musl-libc, stressing scale of affected systems across multiple musl distros beyond Alpine.
-
OX Security Read →
Security company blog connecting AI-assisted testing (17,600 login combos) to discovery; frames the flaw as emblematic of machine-readable edge cases hiding in decade-old interaction logic.
Old software, weird edge cases, combinations nobody thought to test. There's probably a lot more hiding in plain sight.
-
Tech Insider Read →
Names CVE-2026-123158 with CVSS 8.1; maps all five simultaneous exploitation conditions and separates worst-case Alpine cloud defaults from typical embedded exposure.
A password longer than 256 bytes can talk its way past OpenSSH on some Linux systems, and the trick needs no exploit code at all.
-
Threat Landscape Blog Read →
Technical root cause traced to musl crypt() salt-borrowing collision; maps to MITRE ATT&CK T1078/T1190 and provides shadow file audit commands beyond basic patching guidance.
Any password of length 257–1024 bytes is accepted for the * account. Shorter passwords and longer ones are rejected.
-
Shattered.io Read →
Challenges the root-access headline by clarifying PermitRootLogin and doas prerequisites; compares musl vs glibc/PAM stacks and provides shell commands for auditing exposed accounts.
An attacker who can reach your SSH port can log in without knowing any password.
-
PrivacyAffairs Read →
Traces three independently sound design decisions whose 2016 collision went undetected; connects AI-era exploitation speed to OpenSSH abandoning embargo in favor of immediate disclosure.
If you run such a system, stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
-
GBHackers Security Read →
Highlights Alpine cloud images where passwordless doas turns the login bypass into root; confirms AI-driven discovery via approximately 17,600 login combinations across system configurations.
Any password between 257 and 1,024 characters works. It affects Alpine Linux, OpenWrt, Buildroot, and Yocto
Shared on Bluesky by 1 AI expert
-
Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer) Main Link | Techmeme Perma…
View on Bluesky →
Originally reported by bleepingcomputer.com
Read the original article →Original headline: OpenSSH '*sshole' flaw lets 256+ char passwords log into password-disabled Linux accounts on musl systems