OpenSSH has shipped an emergency update after researchers disclosed a password bypass that can open accounts designed never to accept a password. The flaw, CVE-2026-123158, nicknamed "SSHhole", was fixed in Portable OpenSSH 10.6p2 on 5 November 2026 and carries a CVSS score of 8.1, rated High.

The bug affects Linux systems where the SSH server is built against the musl C library and checks passwords itself instead of handing them to PAM. Alpine Linux is the best-known case: its standard openssh-server package is built without PAM, so its default configuration is exposed. OpenWrt, Buildroot and Yocto builds in the same configuration are also at risk. Standard glibc distributions such as Debian, Ubuntu and Red Hat are not affected, and neither are systems where sshd uses PAM.

How a long password opens the door

The mechanism is a logic error. For SHA-256 and SHA-512 password hashes, musl's crypt() refuses passwords longer than 256 bytes and answers with the string "*". OpenSSH has, since 2016, borrowed another account's salt when checking an account whose stored password field is "*", so the two combine: any password between 257 and 1,024 characters is accepted for accounts with no usable password — key-only users, LDAP users and root on modern Alpine. Researcher Özgün Kültekin of Wakefield published the full write-up at sshhole.com.

The fix

No exploitation in the wild has been reported, but public reproduction labs already exist, so working exploits should be assumed available. The fix is OpenSSH 10.6p2, which refuses to compare a password when the stored hash is shorter than four characters; Alpine has shipped patched packages for every supported branch back to 3.16. Anyone who cannot upgrade immediately should set PasswordAuthentication no in sshd_config and restart the service.

Sources: Security Boulevard, SSHhole CVE-2026-123158 and how Ionix is helping you respond, 5 November 2026; ManagingWP, OpenSSH password bypass on Alpine and musl Linux, 5 November 2026; TuxCare, The SSH authentication bypass that lived between OpenSSH and musl, 5 November 2026.