news
Security Emergency in Alpine Linux (musl and OpenSSH)
-
Ruben Schade ☛ ⚠ Update your Alpine Linux OpenSSH NOW
Given I talk about Alpine being my Linux server distro of choice, I feel it important to relay this: [...]
-
LWN ☛ Critical security vulnerability affects OpenSSH on Alpine Linux systems
Version 10.6p2 of OpenSSH has been released with a workaround for a critical vulnerability that affects GNU/Linux systems that use musl libc with PAM disabled, such as Alpine Linux. OpenSSH developer Damien Miller said: [...]
-
Tom's Hardware ☛ Combined flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password — emergency fixes for OpenSSH and musl-libc issued for millions of systems, patch immediately
Meanwhile, the parties involved are playing a game of hot potato with who's fault. The internet is still reeling from the PHP engine vulnerability and all other security vulnerabilities found over the past few weeks, and we're not done. Today's special is quite spicy: you can get into Alpine, OpenWRT, and other Linux distros without needing a password, thanks to a combined bug with OpenSSH and musl libc. Just randomly type over 256 characters on the password prompt and you'll be let in through the SSHhole.
-
Bleeping Computer ☛ OpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed flaw involving OpenSSH and musl, dubbed "*sshole," allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.
-
Hacker News ☛ OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long.
-
The Register UK ☛ Get root on a musl Linux system by slamming it with an overly long password
On certain Linux systems, an attacker could gain root access by entering a password longer than 256 bytes. The vulnerability, dubbed *sshole by Wakefield researcher Özgün Kültekin, who discovered it, can only be exploited in very specific conditions.
The flaw affects certain Linux systems using musl libc instead of the traditional GNU C library, and even then only those running OpenSSH's secure shell daemon without Pluggable Authentication Modules (PAM) and with password authentication enabled.
-
OpenSSH Releases Emergency Fix for Authentication Bypass Affecting Alpine Linux and Other Musl-Based Systems
-
ZDNet ☛ Alpine Linux rebuilt its GitLab server after a close call – what you should check ASAP
On Oct. 20 and Oct. 21, an attacker tried to exploit the nasty GitLab security vulnerability CVE-2026-97229 on Alpine Linux‘s GitLab instance. Alpine confessed the attack “came close to working” in the release about the incident.
Further updates on this:
-
Thoughts on *sshhole – Noë Flatreaud
On November 5, 2026 OpenSSH released 10.6p2 and Alpine Linux published security advisories and openssh packages for a password authentication bypass fix in sshd, CVE-2026-123158 nicknamed sshhole. On an affected system, an attacker who can reach the SSH port can log in to an account that has no password by sending a very long password.
The issue is quite simple to understand. OpenSSH checks passwords by hashing them and comparing the result to the stored value. Accounts with no password store an asterisk symbol. When a user provides a password longer than 256 characters, the musl C library fails to hash it and returns that same asterisk symbol. So OpenSSH sees a match and grants us access to the shell.
The bug affects OpenSSH built against the musl C library without PAM, which is the default openssh-server package on Alpine.
-
OpenSSH Fixes Critical Long-Password Bypass on Alpine Linux
OpenSSH released version 10.6p2 on November 5, 2026, to block a critical login flaw on some Alpine Linux servers. Any password 257 to 1,024 bytes long opens accounts that have no password.
-
Alpine Linux Servers Exposed By OpenSSH Server Login Bypass
Administrators running sshd on Alpine Linux servers are being told to update openssh and restart sshd right away, since upgrading the package alone leaves the old daemon running.
3 more:
-
CSO ☛ OpenSSH flaw lets attackers access password-disabled accounts on some Linux systems
The trivial exploit involves sending an arbitrary extra-long password to an OpenSSH server running on a vulnerable Linux configuration, including the popular Alpine Linux.
-
Security Week ☛ OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
On GNU/Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters.
-
Dolphin Publications B V ☛ OpenSSH vulnerability allows attackers access without a password
A decade-old vulnerability in OpenSSH allows attackers to gain unauthorized access to certain Linux environments without knowing the password. Although the vulnerability primarily affects Alpine Linux, other distributions may also be vulnerable. Security updates have since been released.
2 more:
-
Cybernews ☛ Any long password will do: SSH flaw lets hackers into Alpine systems, routers and more
Any long password, between 257 and 1024 characters, unlocks thousands of Linux systems via SSH (Secure Shell), the industry standard for remote system administration. Attackers only need to reach the vulnerable systems over the SSH port.
-
Hacker News ☛ Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.
PC Gamer:
-
All that stands between a hacker and admin privileges on some Linux distros is a 257-character long string of literally anything
Some implementations of secure shell (SSH), one of Linux's most trusted and secure connection protocols, have been found vulnerable to the most peculiarly simple methods of bypass: spamming characters.
On some distros, simply type 257–1,024 characters and you get access to the root (admin) login. Thankfully, the list of vulnerable distros is quite small and niche, and OpenSSH has already issued a workaround/fix.
3 more:
-
OpenSSH Password Authentication Bypass on Alpine Linux (*sshole) – CVE-2026-123158
A decade-old vulnerability in OpenSSH allows attackers to bypass password authentication on vulnerable Alpine Linux systems simply by entering an unusually long password. Tracked as CVE-2026-123158, the flaw can grant unauthorized access to accounts configured to reject password logins, potentially leading to root-level access on affected cloud systems. OpenSSH and Alpine Linux released fixes on November 5, 2026.
-
Ars Technica ☛ Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
The vulnerability exists in the interaction between OpenSSH, the code library implementing SSH connections, and musl, a lightweight alternative to the libc library that, unlike most other Linux distributions, is used in Alpine. Further, OpenSSH using musl (pronounced muscle) must not use PAM (pluggable authentication modules), a framework that handles user authentication and account-access checks. Alpine is a lightweight, widely used Linux distribution. Other platforms may be affected if they use the same configurations.
-
CVE-2026-123158: OpenSSH sshhole Bypass Hits Alpine Linux
-
IT News AU ☛ Lightweight Linux distros vulnerable to *sshole password bypass
A researcher has unearthed a curious bug in some Linux distributions that lets accounts which shouldn’t take passwords at all accept one, provided it is between 257 and 1024 characters long.
The edge case involves authentication through OpenSSH, the open source secure shell remote access software, and affects lightweight Linux distributions built on musl, an alternative to the standard C library most distributions use.
Original:
GitLab also:
Official and more:
-
Alpine Linux ☛ 2026-11-05 [Older] Alpine 3.21.10, 3.22.8, 3.23.8 and 3.24.4 released
-
ZDNet ☛ Alpine Linux and OpenSSH patch flaw that’s as bad as it can get
The perfect nightmare scenario for a Linux server is when all an attacker needs to do is reach the server’s Secure Shell (SSH) port, waltz right in, and take it over. That’s what happened to Alpine Linux, the popular, lightweight Linux server. Adding insult to injury, this happened only days after Alpine Linux dodged a security hole-sized bullet to its GitLab implementation.
Also here:
-
Security Week ☛ OpenSSH Rushes Patches for 'SSHole' Authentication Bypass
On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters.