OpenSSH Patches ‘SSHole’ Authentication Bypass

OpenSSH has released patches for “SSHole,” an authentication bypass affecting the sshd server on Linux systems that use the musl C library without the Pluggable Authentication Module (PAM). The flaw is tracked as CVE-2026-123158 and has a CVSS severity score of 8.1.

A misinterpretation of password-hash data allows attackers to access certain accounts with any password between 257 and 1,024 characters long. The fix is included in OpenSSH 10.6p2.

The affected setup appears in distributions including Alpine Linux, OpenWrt, Buildroot and Yocto. An attack requires password authentication to be enabled, an account whose password field contains an asterisk and at least one other local account with a password hash beginning with “$5$” or “$6$.” Those prefixes identify SHA-256 and SHA-512 crypt hashes.

Alpine Linux uses an asterisk to secure the root account in releases since version 3.16. The same field can occur on key-only accounts created without passwords, users in Alpine’s official tiny-cloud images and accounts supplied through directory services using musl-nscd.

An attacker who can reach an exposed SSH port needs the name of an account with the asterisk password field. The attacker can then authenticate with a qualifying long password. Alpine Linux reports that the attack uses one connection, succeeds consistently and does not require repeated attempts.

Alpine Linux urged users on Thursday to install the OpenSSH patches and restart sshd so the running daemon is replaced. Users who cannot update should disable password authentication and restart the service, according to the distribution’s guidance.

Alpine Linux reports that all releases it checked are affected, including versions 3.21 through 3.24, the edge branch and older versions 3.16 through 3.20.

OpenSSH developer Damien Miller wrote that the project released the patch quickly after learning of the issue. “We are making this release as fast as possible,” he wrote, citing recent cases in which artificial-intelligence agents rediscovered bugs within hours. Miller added that long disclosure embargoes can give attackers an advantage.

Researchers had not reported exploitation when the warning was issued. Detectify co-founder and principal security researcher Fredrik Almroth described the attack as easy to scan for because millions of systems expose SSH on port 22. WatchTowr head of threat intelligence Jake Knott recommended updating to the latest version or disabling password authentication until an update is available.