Attacks Target New OpenSSH Flaw

OpenSSH has released version 10.6p2, providing a critical security workaround for a vulnerability impacting Linux systems that has been present in some form for many years. 

The vulnerability (CVE-2026-123158)  allows for a password authentication bypass in the OpenSSH daemon (sshd) when the system is built and executed with Pluggable Authentication Modules (PAM) support disabled and utilizes the musl C library. While the OpenSSH development team says the root cause of this flaw exists outside the sshd codebase itself, the vulnerability is directly exploitable through the daemon, requiring an immediate patch to prevent unauthorized access.

Researchers have already detected exploitation attempts against this bug, which was disclosed on Nov. 5. Within hours, botnets and other automated systems were attempting to exploit it, according to data from watchTowr. Security firm Previdian has also observed some limited exploit attempts in the past 24 hours/

Researcher Ozgun Kultekin discovered the vulnerability while digging through the OpenSSH codebase and discovered that systems with the specific configuration detailed above will accept any password that’s longer than 256 characters. That includes accounts that should not take any password. 

“Accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine’s aws and azure images) take any password longer than 256 characters.Yes, any password. Yes. I know. Yes,” Kutelkin said in his advisory for the bug, which he named *sshole.

“I was messing around with openssh, mostly the boring parts where it talks to libc, like the password code. People don’t really look at that stuff, they look at the crypto. So I built sshd every way i could think of (glibc, musl, pam, no pam, shadow, no shadow) and threw like 17,600 weird logins at it. Weird hashes, broken accounts, passwords way too long.”

Security teams should patch systems affected by CVE-2026-123158 as soon as possible, given how simple it is to exploit and how many affected systems are likely available online.

The vulnerability stems from a logic error in how sshd handles password authentication on these specific system configurations. When an unauthenticated remote attacker submits an arbitrary password between 257 and 1024 characters to an account that lacks a valid password hash, the musl crypt() function returns an asterisk as an error signal. Because the target account’s shadow file entry also contains an asterisk to indicate no password is set, the sshd daemon incorrectly identifies the values as a match and grants access. 

This primarily affects Alpine Linux deployments, including official cloud images, as well as appliances built with Buildroot, Yocto, or OpenWrt that are configured without PAM.

The primary remediation path is to upgrade to OpenSSH 10.6p2, which updates the daemon to explicitly reject stored password hashes that are too short to be legitimate, effectively closing the bypass vector. Administrators must ensure that the sshd daemon is restarted following the package upgrade, as simply updating the binaries does not replace the process currently running in memory. If immediate patching isn’t possible, teams should disable password-based authentication by setting PasswordAuthentication no in the sshd_config file and performing a daemon restart.

Security teams should also audit sshd logs for any instances of successful password-based logins on accounts that historically do not use them, such as the default alpineuser in common cloud images. Because vulnerable container images and cloud instances often persist long after a package fix is released, teams should prioritize rebuilding and redeploying infrastructure from verified, patched base images rather than relying solely on individual system updates, which may not catch stale persistent storage.