SSH is the front door I use on every Linux server I run. This week that door turned out to have a strange fault on some systems: type a password that is far too long, and an account that was never supposed to accept a password at all lets you in. It sounds like a joke setup. It is not. OpenSSH rushed out an emergency fix on November 5, and by today researchers were already seeing attempts to use it.
What happened
The flaw is tracked as CVE-2026-123158, rated 8.1 out of 10, and nicknamed SSHole. SecurityWeek reports that it affects the OpenSSH server, sshd, on Linux distributions that use the musl C library with PAM — the Pluggable Authentication Module — disabled. Researcher Özgün Kültekin of Wakefield found it and gave it the name.
Here is the mechanism, in plain terms. Some accounts should never take a password — root on many systems, a key-only deploy user, the default user on some cloud images. Their entry in the password file is marked with a single asterisk, *, meaning no password is set. On an affected system, when someone sends a password between 257 and 1,024 characters long, musl’s crypt function returns that same asterisk as an error signal. sshd then compares the two asterisks, treats them as a match, and grants access. As SecurityWeek puts it, it is a misinterpretation of whether a string is intended to be a password hash.
Alpine Linux is the main case, because its standard openssh-server package is built that way. SecurityWeek notes that Alpine checked every release from 3.21 through 3.24 and edge, plus older releases from 3.16 to 3.20. Builds based on OpenWrt, Buildroot, and Yocto were also named as potentially affected. Alpine adds two more conditions: the target account’s password field has to be that asterisk, and the machine needs at least one other account with a $5$ or $6$ password hash — the SHA-256 or SHA-512 crypt formats.
OpenSSH developer Damien Miller said the flaw is not in sshd itself, but can be exploited through it. The fix shipped in OpenSSH 10.6p2, released as fast as possible after the team learned of the problem the day before. Decipher reports that, within hours of the November 5 disclosure, botnets were attempting to exploit it, citing watchTowr data, and that Previdian saw limited attempts in the past 24 hours. People noticed immediately.
How bad is it, honestly?
For an affected machine, this is as bad as an authentication bypass gets. Alpine’s warning, quoted by SecurityWeek, is blunt: an attacker who can reach your SSH port can log in without knowing any password, in one connection, every time, with no retries. No race to win, no guessing, no stolen key. If that account is root or has admin rights, the server is theirs.
Now the limits, because they matter for triage. This is not every Linux server. The conditions have to line up: musl, no PAM, password authentication enabled, an asterisk account, and another account with a suitable hash. A server that does not use musl, or that checks passwords through PAM, does not meet the conditions described in the reporting. Most mainstream server installs will fall outside this. Your Alpine hosts, containers, appliances, and small embedded builds are where I would look first — exactly the places that are easy to forget because they usually just work.
I am also not going to pretend patching is complicated here. The fix exists, the vendor instructions are short, and the attack is simple and cheap to try at scale. That combination — easy attack, easy fix, public details — is exactly when waiting costs the most.
What to actually do
First, inventory anything running sshd on Alpine or another musl-based build, including cloud images and containers that run SSH. Check the effective configuration with sshd -T and look at whether PAM is in use and whether password authentication is on. Do not rely only on a version banner — distributions backport fixes, so check your package updates too.
Second, patch and restart. On Alpine, run apk upgrade -U -a, then restart sshd with rc-service sshd restart. Elsewhere, update to OpenSSH 10.6p2 or your distribution’s fixed package. The restart is not optional: upgrading the package does not replace the daemon already running in memory, and that old process will keep accepting logins until it is replaced.
Third, if you cannot patch a host today, turn password logins off. Set PasswordAuthentication no, restart sshd, and keep a working key-based session open while you test a new login, so you do not lock yourself out. For most servers I run, key-only SSH is the right long-term setting anyway, not just a temporary workaround.
Fourth, look backwards. Decipher advises auditing sshd logs for successful password logins on accounts that normally never use them, such as the default user in common cloud images. And if you build from Alpine-based images, rebuild and redeploy from a patched base image instead of only patching running instances, so a stale image does not reintroduce the flaw next time you deploy.
My bottom line: check your smallest Linux boxes first — the Alpine containers and appliances nobody thinks about. That is where this one lives, and today is the day to close it.
Sources: SecurityWeek, “OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass” (November 6, 2026) — securityweek.com/openssh-rushes-patches-for-sshole-authentication-bypass; Decipher, “Attacks Target New OpenSSH Flaw” (November 6, 2026) — decipher.sc/2026/11/06/attacks-target-new-openssh-flaw.