# *sshole (CVE-2026-123158): OpenSSH password authentication bypass on musl without PAM · VamiSec

> Briefing and exposure-check page by VamiSec GmbH (Bonn, Germany). It summarizes CVE-2026-123158 ("*sshole", also written sshole and sshhole), a password authentication bypass in the OpenSSH server sshd on Linux systems that use the musl C library and check passwords without PAM, such as Alpine Linux. It lists the five preconditions, fixed package versions per Alpine branch, an in-browser self-test, read-only check commands, immediate mitigations, detection hints and EU/German reporting duties, and offers a short-notice exposure check from the outside (recon and attack surface management with VamiRedteam) and from the inside (read-only checks of servers, container images and devices).

Status: 2026-11-06. Key facts, all from primary sources linked on the pages:
- What: for accounts whose password field in /etc/shadow is exactly "*", sshd before OpenSSH 10.6p2 accepts any password of 257 to 1,024 bytes when it runs on musl and checks passwords without PAM. musl's crypt() returns the string "*" on failure (SHA-crypt keys over 256 bytes fail); for accounts without a usable salt, sshd borrows the salt of another account (pick_salt(), added in 2016 against CVE-2016-6210 in OpenSSH 7.3p1) and then compares the "*" error string with the stored "*". The CVE record says 256 to 1,024 characters; tests by the discoverer and Alpine show 257 to 1,024 bytes.
- Preconditions (all required): musl libc; sshd checks passwords without PAM (Alpine openssh-server, or openssh-server-pam with UsePAM no, the OpenSSH default); PasswordAuthentication yes (the OpenSSH default); a target account with exactly "*" (on Alpine root since about 3.16, but PermitRootLogin prohibit-password protects root; key-only accounts; directory users via musl-nscd; the alpine user in official tiny-cloud images); at least one other local account with a password hash, typically $5$ or $6$ (per IONIX the first $-hash in /etc/passwd order counts: SHA or bcrypt makes it exploitable, bcrypt before 10.6p2 even with short passwords; MD5 $1$ or yescrypt $y$ do not). Locked accounts with "!" are not affected.
- Impact: login without a password; on Alpine tiny-cloud images 3.18.11 through 3.24.3 the alpine user has "*" and passwordless doas, so the bypass leads to root as soon as any $6$ hash exists on the machine. Alpine: one connection, works every time.
- Not affected: glibc systems (Debian, Ubuntu, RHEL, Fedora, SUSE), systems that check passwords via PAM, non-Linux systems, Dropbear, containers that do not run sshd. Red Hat states its products are not affected.
- Fix: Portable OpenSSH 10.6p2 (November 5, 2026; commit 4353fdc "avoid password authn bypass" requires a stored hash of at least four characters). Alpine fixed packages: edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7, 3.16 9.0_p1-r6; point releases 3.21.10, 3.22.8, 3.23.8, 3.24.4. On stable branches sshd -V still reports the old OpenSSH version; the package version decides. Restart sshd after upgrading.
- Mitigation: PasswordAuthentication no (test key login first; Alpine before 3.19 ignores sshd_config.d drop-ins; Match blocks can re-enable passwords), or PAM with UsePAM yes, plus network restrictions.
- Severity and status: CNA MITRE, CVSS 3.1 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), CWE-394; OpenSSH calls it critical. CISA SSVC (November 5): exploitation poc, automatable no, technical impact total. Not yet in CISA KEV (latest catalog of November 4 predates the disclosure). No known exploitation as of the status date; public proof of concept by the discoverer.
- Discovery: Özgün Kültekin of Wakefield, using agent swarms that ran about 17,600 unusual logins against sshd builds (per the write-up); reported November 3, released November 5. OpenSSH release notes since 10.5 report many AI-assisted bug reports; Damien Miller wrote on November 5 that the team now considers long embargo periods dangerous because AI agents rediscover reported bugs, sometimes within hours.
- This page is published by VamiSec GmbH, not by the OpenSSH project, Alpine Linux or the discoverer.

## Pages

- [*sshole – Deutsch](https://sshole.eu/): German page (primary)
- [*sshole – English](https://sshole.eu/en/): English page
- [VamiSec news](https://vamisec.com/en/news): VamiSec news overview

## Primary sources

- [OpenSSH 10.6p2 release notes](https://www.openssh.com/releasenotes.html#10.6p2): OpenSSH project, November 5, 2026
- [Fix commit 4353fdc](https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482): "avoid password authn bypass"
- [CVE-2026-123158](https://www.cve.org/CVERecord?id=CVE-2026-123158): CVE record by the CNA MITRE with CISA SSVC
- [Alpine security advisory](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/): preconditions, fixed packages, cloud images, detection
- [sshhole.com](https://sshhole.com/): write-up by the discoverer
- [oz9un/sshole](https://github.com/oz9un/sshole): check.sh, proof of concept, lab and patch (MIT)
- [oss-security announcement](https://www.openwall.com/lists/oss-security/2026/11/05/2): Damien Miller, November 5, 2026

## VamiSec

- [VamiRedteam](https://vamiredteam.com/): agentic platform for recon, attack surface management and pentesting
- [Brotli2Shell briefing](https://brotli2shell.wiz.vamisec.com/): VamiSec briefing on CVE-2026-111497
- [VamiSec](https://vamisec.com/): AI-driven IT security and GRC, Bonn