OpenSSH flaw lets attackers access password-disabled accounts on some Linux systems

Publisher excerpt From CSO Online

A critical vulnerability that affects OpenSSH servers on Linux systems built with the musl C library instead of glibc allows remote attackers to easily bypass authentication and log into accounts that should have password authentication disabled. The flaw impacts the lightweight Alpine Linux, which is widely used for cloud Docker container images, as well as Linux distributions for embedded systems. The security bug, dubbed *SSHole and tracked as CVE-2026-123158, was discovered by Ozgun Kultekin, a researcher with security testing firm Wakefield, and has existed for the past 10 years. The OpenSSH maintainers moved quickly to add mitigation for the flaw in the OpenSSH 10.6p2 emergency update released Thursday, even though they claim the bug is not actually in their code. “It’s not every day that the ‘exploit’ for a vulnerability in a technology as prevalent as OpenSSH is just ‘send a long password’ or ‘send a lot of A characters,’ but here we are,” said Jake Knott, head of threat intelligence at preemptive exposure management firm watchTowr. “On affected systems, the exploit is strikingly simple: send a password between 257 and 1,024 characters long.” Luckily, there are some prerequisites for this exploit to work: The Linux distribution needs to use musl, which means that many popular server distros such as Debian, Ubuntu, and Fedora are not impacted The system needs to use OpenSSH and not alternative SSH server implementations such as Dropbear, which many embedded distros use OpenSSH needs to be configured without support for Pluggable Authentication Modules (PAM), the most common Linux login framework OpenSSH needs to allow password-based authentication The attacker needs to know the name of an account for which password login has been disabled at the system level Those conditions are met in default configuration for Alpine Linux and its built-in “alpine” username, which allows executing commands as root. The Alpine project released emergency updates for the openssh package and advises users who can’t update to disable password-based authentication in the OpenSSH configuration and set up key-based authentication. Why the trivial attack works The flaw is the product of three changes made years apart, each solving a different problem. In 2012, musl’s developers capped password length at 256 bytes to stop attackers from tying up server resources by sending long passwords that need to be hashed as part of the login verification process. At the same time they also made the library’s password hashing function return an asterisk (*) whenever it fails. The asterisk is the same character Unix has used since the 1980s to mark accounts for which no password should ever match — accounts with password disabled at the system level. In 2016, OpenSSH changed how it checks passwords for accounts whose own password field offers no salt to hash against, borrowing another account’s salt so that attackers could not guess existing usernames with brute-f…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.