Critical Openssh Flaw Let Long Passwords Bypass Linux Login Checks
WHO:
The Hacker News - Previdian reported exploitation attempts; founder and CEO Ryan Dewhurst described the activity. Safe Security said an attacker gains the compromised account’s existing permissions.
The Hacker News - OpenSSH rated the vulnerability critical and released a fix; Damien Miller of the OpenSSH project advised affected-system operators to “set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.”
The Hacker News - Özgün Kültekin of Wakefield reported the flaw. His technical write-up names OpenWrt, Buildroot, and Yocto as other musl-based systems to check.
Techmeme - BleepingComputer’s Lawrence Abrams described researcher-reported *sshole as a decade-old OpenSSH flaw affecting some musl-based Linux systems.
WHAT:
The Hacker News - The flaw is tracked as CVE-2026-123158, with a CVSS score of 8.1. Previdian confirmed successful root access on an Alpine Linux honeypot and recorded eight exploitation attempts.
The Hacker News - The source IP, 89.116.89[.]18, was geolocated to Japan; attackers ran `id`, `uname`, and `hostname` through non-interactive SSH sessions.
The Hacker News - Safe Security said compromised accounts may expose deployment credentials, application secrets, and connected infrastructure, potentially enabling lateral movement or service disruption.
The Hacker News - The *sshole flaw can let a network attacker log in to certain passwordless accounts on affected Linux servers using a password from 257 to 1,024 bytes long. The attacker needs network access and the account name; the attack can succeed on every try with a single connection.
Techmeme - The vulnerability allows attackers to use a password of 256 or more characters to access passwordless accounts on some musl Linux systems.
The Hacker News - OpenSSH released version 10.6p2, and Alpine published fixed packages for every release back to 3.16. Fixed Alpine point releases listed are 3.21.10, 3.22.8, 3.23.8, and 3.24.4.
The Hacker News - No attacks exploiting the flaw had been reported, and no CVE identifier had been assigned.
Ars Technica - Certain Alpine configurations are affected; other distributions may also be vulnerable.
WHERE:
The Hacker News - The flaw affects some Alpine Linux servers running the standard `openssh-server` package. OpenWrt is affected only if an administrator installs OpenSSH; it uses Dropbear by default, and Dropbear is not affected.
The Hacker News - Non-Linux systems, glibc-based Linux systems, and systems that authenticate passwords through PAM are not affected.
WHY:
The Hacker News - The issue requires password authentication to be enabled, SSH password checking without PAM, at least one passwordless account, and at least one other local account with a `$5$` or `$6$` password hash.
The Hacker News - In musl, `crypt()` rejects passwords longer than 256 bytes and returns `*`. Because a passwordless account’s stored field is also `*`, sshd can treat the failed hash as a match.
HOW:
The Hacker News - Previdian observed the first exploitation attempt less than nine hours after the CVE was published.
The Hacker News - Alpine operators can update packages and restart sshd; upgrading alone does not restart the running service. Disabling password authentication also blocks the attack.
The Hacker News - Version 10.6p2 prevents a match when the stored password field is shorter than four characters.
(UPDATED November 6, 2026 22:08 UTC)
A critical OpenSSH flaw lets attackers access passwordless accounts on some musl-based Linux servers. Previdian confirmed root access on an Alpine honeypot and recorded eight exploitation attempts. OpenSSH released a fix; affected operators should disable password authentication, update packages, and restart sshd.
--
(UPDATED November 6, 2026 17:04 UTC)
A critical OpenSSH flaw lets attackers access passwordless accounts on some musl-based Linux servers. OpenSSH released a fix, and Alpine Linux published patched packages across supported releases. Operators should disable SSH password authentication or update packages and restart the service immediately.