{"id":10338,"date":"2026-11-06T01:10:08","date_gmt":"2026-11-06T01:10:08","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10338"},"modified":"2026-11-06T01:10:08","modified_gmt":"2026-11-06T01:10:08","slug":"openssh-flaw-lets-attackers-access-password-disabled-accounts-on-some-linux-systems","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10338","title":{"rendered":"OpenSSH flaw lets attackers access password-disabled accounts on some Linux systems"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

A critical vulnerability that affects OpenSSH servers on Linux systems built with the musl C library instead of glibc allows remote attackers to easily bypass authentication and log into accounts that should have password authentication disabled. The flaw impacts the lightweight Alpine Linux, which is widely used for cloud Docker container images, as well as Linux distributions for embedded systems.<\/p>\n

The security bug, dubbed *SSHole<\/a> and tracked as CVE-2026-123158<\/a>, was discovered by Ozgun Kultekin, a researcher with security testing firm Wakefield, and has existed for the past 10 years. The OpenSSH maintainers moved quickly to add mitigation for the flaw in the OpenSSH 10.6p2<\/a> emergency update released Thursday, even though they claim the bug is not actually in their code<\/a>.<\/p>\n

\u201cIt\u2019s not every day that the \u2018exploit\u2019 for a vulnerability in a technology as prevalent as OpenSSH is just \u2018send a long password\u2019 or \u2018send a lot of A characters,\u2019 but here we are,\u201d said Jake Knott, head of threat intelligence at preemptive exposure management firm watchTowr. \u201cOn affected systems, the exploit is strikingly simple: send a password between 257 and 1,024 characters long.\u201d<\/p>\n

Luckily, there are some prerequisites for this exploit to work:<\/p>\n

The Linux distribution needs to use musl, which means that many popular server distros such as Debian, Ubuntu, and Fedora are not impacted<\/p>\n

The system needs to use OpenSSH and not alternative SSH server implementations such as Dropbear, which many embedded distros use<\/p>\n

OpenSSH needs to be configured without support for Pluggable Authentication Modules (PAM), the most common Linux login framework<\/p>\n

OpenSSH needs to allow password-based authentication<\/p>\n

The attacker needs to know the name of an account for which password login has been disabled at the system level<\/p>\n

Those conditions are met in default configuration for Alpine Linux and its built-in \u201calpine\u201d username, which allows executing commands as root. The Alpine project released emergency updates for the openssh package<\/a> and advises users who can\u2019t update to disable password-based authentication in the OpenSSH configuration and set up key-based authentication.<\/p>\n

Why the trivial attack works<\/h2>\n

The flaw is the product of three changes made years apart, each solving a different problem. In 2012, musl\u2019s developers capped password length at 256 bytes to stop attackers from tying up server resources by sending long passwords that need to be hashed as part of the login verification process.<\/p>\n

At the same time they also made the library\u2019s password hashing function return an asterisk (*) whenever it fails. The asterisk is the same character Unix has used since the 1980s to mark accounts for which no password should ever match \u2014 accounts with password disabled at the system level.<\/p>\n

In 2016, OpenSSH changed how it checks passwords for accounts whose own password field offers no salt to hash against, borrowing another account\u2019s salt so that attackers could not guess existing usernames with brute-force login retries and timing the server\u2019s responses. Then in 2022, Alpine switched root\u2019s password field to an asterisk so that SSH key logins would keep working for it.<\/p>\n

When an attacker sends an over-long password for a password-disabled account on such a system, the hash attempt fails and returns an asterisk, which sshd compares with the asterisk stored in the account\u2019s password field. The two match, and the login succeeds.<\/p>\n

Alpine Linux cloud images will be the main target<\/h2>\n

Alpine\u2019s standard OpenSSH package is built without PAM, and password logins are enabled by default, so Alpine servers meet the conditions out of the box. On the official cloud images published between versions 3.18.11 and 3.24.3, the default user account, named alpine, is one of the password-disabled accounts, and the images grant it passwordless \u201cdoas\u201d privileges.<\/p>\n

As a result, an attacker who logs in as that user can then switch to root, so the images are exposed as soon as an administrator sets a password for any other account on the system, because a legitimate account with a real password needs to exist for this attack to work.<\/p>\n

Unlike the critical regreSSHion flaw from 2024<\/a>, this one is confined to the musl world, but it requires no exploit engineering of any kind.<\/p>\n

\u201cInternet-exposed SSH servers are already being hammered by password guesses and brute-force attempts around the clock<\/a>,\u201d Knott said. \u201cExploiting this vulnerability simply means those same attackers add a very long password attempt to that brute-force list. We\u2019d be extremely surprised if we didn\u2019t see SSH brute-forcers attempting this by the weekend.\u201d<\/p>\n

Organizations should also check whether the flaw was already used against their servers. An \u201cAccepted password\u201d entry in \/var\/log\/messages for an account that has no password, such as root, a key-only user, or the default alpine user, is a strong sign of compromise.<\/p>\n

Alpine recommends reviewing doas usage, recently created users and files on exposed machines, and its advisory says any server where a login cannot be ruled out should be treated as compromised. Kultekin also published a check script on GitHub<\/a> that identifies exposed servers and lists the accounts at risk.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

A critical vulnerability that affects OpenSSH servers on Linux systems built with the musl C library instead of glibc allows remote attackers to easily bypass authentication and log into accounts that should have password authentication disabled. The flaw impacts the lightweight Alpine Linux, which is widely used for cloud Docker container images, as well as […]<\/p>\n","protected":false},"author":0,"featured_media":10339,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10338","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10338"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10338"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10338\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10339"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}