OpenSSH Flaw Lets Attackers Access Password-Disabled Accounts on some Linux Systems
The bug affects musl-based Linux servers and lets attackers log in to accounts marked with * after entering an oversized password, researchers said.
- On Thursday, security researcher Ozgun Kultekin disclosed a vulnerability dubbed "*sshole" affecting OpenSSH on musl-based Linux systems, allowing attackers to bypass password authentication on accounts configured to block it.
- The vulnerability stems from the musl C library's crypt function, which returns an asterisk upon hashing failures, causing OpenSSH's dummy password hashing to inadvertently match the asterisk used to disable accounts.
- Kultekin discovered the flaw using AI agents that ran about 17,600 authentication tests; exploitation requires systems running OpenSSH without Pluggable Authentication Modules and passwords between 257 and 1,024 characters.
- Developers released a fix in OpenSSH build 10.6p2 on Thursday, and administrators unable to update immediately can mitigate risk by disabling password authentication in their SSH server configuration.
- Kultekin warns that official Alpine Linux cloud images for AWS and Azure contain a default "alpine" account with passwordless privileges; administrators can check logs for "Accepted password" entries to detect exploitation.
27 Articles
27 Articles
OpenSSH flaw lets attackers access password-disabled accounts on some Linux systems
A critical vulnerability that affects OpenSSH servers on Linux systems built with the musl C library instead of glibc allows remote attackers to easily bypass authentication and log into accounts that should have password authentication disabled. The flaw impacts the lightweight Alpine Linux, which is widely used for cloud Docker container images, as well as Linux distributions for embedded systems. The security bug, dubbed *SSHole and tracked a…
BleepingComputer
SlashdotOpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. [...]
OpenSSH 10.6p2 Fixes Password Authentication Bypass on Some Linux Systems
The OpenSSH project released version 10.6p2 on 5 November 2026 to address a password-authentication bypass affecting some Linux systems built and run without Pluggable Authentication Modules. The project describes the change as a critical security workaround. This post: OpenSSH 10.6p2 Fixes Password Authentication Bypass on Some Linux Systems is first published on Compsmag.com
Coverage Details
Bias Distribution
- 100% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
