What happened
- Researcher Ozgun Kultekin disclosed on 5 November 2026 a flaw named *sshole in the interaction between OpenSSH and musl, a lightweight C library used by Linux distributions such as Alpine.
- An attacker can get into certain accounts set to block passwords simply by entering a password of more than 256 characters.
- Alpine’s maintainers summed it up this way: anyone who can reach the SSH port can log in without knowing any password, with one connection and no retries.
- OpenSSH published the fix in version 10.6p2 that same Thursday. Alpine also released its update.
Why it matters
- Linux marks accounts that must not use a password with an asterisk. That protective sign is exactly what the flaw turns into a way in.
- Alpine is used in routers, smart TVs and industrial controllers, many of them hard or impossible to update, according to Ars Technica.
- Its official AWS and Azure images come with an affected alpine account with passwordless doas privileges, which could give administrator access, Kultekin warns.
The number
256 bytes. That is the limit of musl’s crypt() function. If the password exceeds it, the function returns an asterisk, which OpenSSH compares with the asterisk stored for the account. They match, and access is granted.
Context
The bug was born from a fix. In 2016, OpenSSH changed its behaviour to correct flaw CVE-2016-6210, which made it possible to deduce usernames from response times. Since then it computes a hash even for accounts with no usable password, and that is where it crosses paths with musl.
There are conditions: a musl system, PAM authentication disabled, as is the default in Alpine, and an account with an asterisk. Check Point adds that another account must use SHA256 or SHA512, because sshd borrows its salt. Systems with glibc, such as Debian, Ubuntu and Fedora, are not vulnerable. Nor can passwords be bypassed on accounts with a valid hash.
OpenSSH and musl disagree about where the root lies: each places responsibility on the other side. Ars Technica also notes that no assigned CVE is known. Kultekin says he found it with AI agents that ran about 17,600 authentication tests.
At Mamífero we have followed flaws of this kind. We reported that PHP fixed two remote execution flaws stalled for two years and that attackers used the cPGuard update to steal data. Also that WorkOS suffered an automated attack and that Claude tested the security of 123 open libraries.
What’s next
- Alpine administrators should run
apk upgrade opensshor, if they cannot, disablePasswordAuthenticationin SSH. - It is worth checking logs for password logins on accounts that should not allow them.
- It has yet to be confirmed whether OpenWrt, Buildroot and Yocto are affected: OpenWrt uses Dropbear by default rather than OpenSSH, according to Ars Technica.
Bottom line
A 2016 fix and an error value in another library left a door open for ten years. The hard part now will be closing it on devices nobody updates.
Sources
- BleepingComputer, “OpenSSH flaw lets attackers log into password-disabled Linux accounts”, 5 November 2026, link.
- Ars Technica, “Meet *sshole, the vulnerability that lets hackers SSH into Linux devices”, 5 November 2026, link.
- Cover image: Esquilo, CC BY-SA 3.0, via Wikimedia Commons
Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.
