OpenSSH *sshole: How a 257-Character Password Breaches Root Access

What looked like an obscure edge-case bug — a string comparison mishap in a specific library combination — has become one of the most consequential vulnerabilities of the autumn. The flaw, dubbed \*sshole (CVE-2026-123158) by Wakefield researcher Özgün Kültekin, lives in the almost invisible intersection between OpenSSH and musl libc, the lightweight C library that powers Alpine Linux, OpenWrt, Buildroot, and countless container images. The result: anyone with network access can log into accounts configured to reject password logins — including root — simply by sending a password between 257 and 1,024 characters.

A fix has been available since November 5 (OpenSSH 10.6p2), but proof-of-concept exploit code appeared publicly four hours later. By November 9, CISA had already added the flaw to its Known Exploited Vulnerabilities catalog, with a November 12 deadline for U.S. federal agencies. Firms including GreyNoise, watchTowr, Previdian, and Defused have all confirmed active exploitation since November 7.

How *sshole works

The vulnerability's mechanics are elegant in their simplicity. When OpenSSH's sshd runs on a system using musl libc without PAM (Pluggable Authentication Modules), password verification operates in a simplified mode: sshd asks the C library to hash the entered password and compares the result to the value stored in `/etc/shadow`. Accounts configured to reject password login have an asterisk (`*`) in their hash field.

Here is the problem: musl libc, when asked to hash a password longer than 256 bytes, silently fails and returns `*` — the same value used to indicate "no valid password." OpenSSH, in turn, interprets that return value as a successful hash match. The result: by sending 257 characters (or any amount between 257 and 1,024) as a password, an attacker gains successful access.

The root cause dates back to 2016, when a patch to fix a username enumeration vulnerability (CVE-2016-6250) introduced the comparison logic. Nine years later, Kültekin identified that the patch did not account for musl's specific behavior. He describes the flaw at sshhole.com, where he details all the conditions required.

Who is at risk

Not every Linux server is in danger. The attack only works when all of the following conditions are true:

1. The server runs OpenSSH on musl libc (not glibc — Debian, Ubuntu, Fedora, and Red Hat are safe) 2. OpenSSH was compiled without PAM (Alpine Linux's default) 3. Password authentication is enabled (OpenSSH default) 4. There is at least one account with `*` in the hash field and another with a valid hash on the system

This combination is common in: - Alpine Linux — the most affected distribution, with backported fixes since version 3.16 - Alpine-based container images — the official `alpine:tiny-cloud` image from 3.18.11 through 3.24.3 includes the `alpine` user with no password and `doas` privileges - Routers and embedded devices — OpenWrt, Buildroot, and Yocto builds using musl - AWS/Azure cloud images — where the default user may have passwordless elevation privileges

Systems with PAM enabled, glibc systems, and cloud-init configured images (which disable password login) are not affected.

The exploitation timeline

The *sshole exploitation timeline is a case study in speed:

- November 5, 09:14 UTC — OpenSSH 10.6p2 released; Alpine publishes fixed packages - November 5, ~13:00 UTC — public exploit code on GitHub - November 7, 00:46 UTC — GreyNoise records first successful exploitation on its honeypot network - November 7 — watchTowr confirms botnet and crypto miner attacks - November 9 — CISA adds CVE-2026-123158 to KEV with November 12 deadline

Previdian identified 22 exploitation attempts from 14 unique IPs by November 9. GreyNoise confirmed 16 post-exploitation sessions from 6 malicious IPs. Observed attacks include reconnaissance commands (`id`, `uname`, `hostname`), new user creation, `authorized_keys` modification, and miner installation.

The community response

The OpenSSH project's reaction was unusually swift. Developer Damien Miller classified the fix as a "critical security workaround" and alerted the community via oss-security and Mastodon: "stop reading and set `PasswordAuthentication=no` or disable SSH for these systems IMMEDIATELY".

The Alpine Linux team backported the fix to all active versions since 3.16 — including releases that were already out of support. The team also recommended restarting `sshd` after updating, since the runtime state variable that detects invalid passwords is not automatically re-evaluated.

CISA, meanwhile, added the flaw to the KEV on November 9, which mandates U.S. federal agencies to mitigate the risk by November 12 under Binding Operational Directive 26-04.

What to do now

For administrators facing panic, the path of least resistance is clear:

1. Update OpenSSH to 10.6p2 (or your distribution's backported package). On Alpine, run `apk upgrade -U -a` and compare the version with the official advisory — backported versions may have a lower number than 10.6p2 2. If you cannot update immediately, disable password authentication: `PasswordAuthentication no` in `sshd_config`, followed by a service restart 3. Check for compromise: review `doas` users, `authorized_keys`, recently modified files. If there is any doubt about a successful login, treat the machine as compromised 4. Scan your infrastructure: the Cloudflare SSHole Lab and Google goonami-scanner offer passive detection tools

Why this matters

The *sshole is an uncomfortable reminder that Open Source security depends on dependency chains that extend far beyond the software itself. The bug is not in OpenSSH — the project considers the root cause "outside sshd." It is in musl libc, in the way the C library handles cryptographic operation failures. And musl, in turn, is chosen by developers seeking smaller, faster images for containers.

What makes the flaw particularly disturbing is that it was discovered by a single researcher who built OpenSSH in multiple configurations — glibc/musl, with/without PAM, with/sha256/sha512 — and noticed one divergence. The discovery tool was human, not automated. And yet the bug had been there since 2016. What changes is not the existence of the bug, but the ability of AI-assisted code generation tools to find these patterns at scale.

The question this leaves is not about *sshole itself — it is about how many others like it are waiting for someone with enough time and curiosity to build the system wrong and notice it behaves unexpectedly.

Sources: BleepingComputer, Cloudflare Radar, BleepingComputer

✓ Independent sources cross-checked and verified before publishing