OpenSSH and Alpine Fix SSHole Authentication Flaw

OpenSSH and Alpine Linux released fixes on November 5 for a password-authentication flaw that could let attackers access certain passwordless accounts on vulnerable systems. The issue, tracked as CVE-2026-123158 and nicknamed SSHole, affects some configurations using OpenSSH and the musl C library, including Alpine’s standard OpenSSH server package. An attacker who can reach a system’s SSH port could exploit the flaw with an unusually long password, without knowing the account’s password. The vulnerable setup requires password authentication to be enabled, an account with no password hash, and another local account with a suitable password hash. OpenSSH must also be checking passwords without PAM. The attack can succeed in a single connection. The flaw arises from how OpenSSH, musl and passwordless accounts interact. When sshd checks a password, it can use another account’s salt if the target account has no usable password hash. For passwords longer than 256 bytes, musl’s crypt function returns an error value that can match the passwordless account’s stored field, causing authentication to be accepted. OpenSSH 10.6p2 contains a fix, and Alpine published corrected packages for...