OpenSSH and Alpine patch SSHole authentication flaw

OpenSSH and Alpine Linux have released fixes for SSHole, a flaw that can let attackers access certain password-disabled accounts on some musl-based Linux systems. Security firm Previdian reported seeing an exploitation attempt less than nine hours after disclosure and confirmed root access on an Alpine Linux honeypot.

The vulnerability affects OpenSSH servers running on musl-based Linux when Pluggable Authentication Modules (PAM) are disabled and password authentication is enabled. Alpine’s default OpenSSH configuration meets those conditions. The flaw does not affect systems using glibc, password authentication through PAM, or the alternative SSH server Dropbear.

An attacker can send a password between 257 and 1,024 bytes long to trigger the problem. On affected systems, musl’s password-hashing function returns an asterisk when it rejects an oversized password. That matches the marker stored for accounts without usable passwords, which OpenSSH can mistakenly treat as successful authentication. The issue does not bypass authentication for accounts with valid password hashes, and an attacker must know the name of an eligible account.

The vulnerability, tracked as CVE-2026-123158...