OpenSSH flaw lets attackers access password-disabled accounts on some Linux systems

Source: CSO Online

Author: unknown

URL: https://www.csoonline.com/article/4245407/openssh-flaw-lets-attackers-access-password-disabled-accounts-on-some-linux-systems.html

ONE SENTENCE SUMMARY:

SSHole (CVE-2026-123158) enables trivial long-password authentication bypass on musl-based OpenSSH, heavily impacting Alpine defaults and cloud images.

MAIN POINTS:

1. Vulnerability affects OpenSSH on Linux built with musl instead of glibc.
2. Attack bypasses system-level disabled passwords by submitting 257–1,024 character passwords.
3. Bug is dubbed SSHole, tracked as CVE-2026-123158, and existed for a decade.
4. OpenSSH shipped mitigation in emergency update 10.6p2 despite disputing code ownership.
5. Exploit requires musl, OpenSSH (not Dropbear), and builds without PAM support.
6. Password authentication must be enabled, and attacker must know a disabled-password username.
7. Alpine defaults satisfy prerequisites, notably the built-in alpine user with root-capable doas.
8. Root cause combines musl’s 256-byte cap and “*” failure return with OpenSSH salt-handling changes.
9. Official Alpine cloud images 3.18.11–3.24.3 expose alpine as password-disabled with privileged escalation.
10. Detection includes logs showing “Accepted password” for passwordless accounts; treat uncertain hosts as compromised.

TAKEAWAYS:

1. Prioritize patching musl-based OpenSSH to 10.6p2 or vendor-fixed packages immediately.
2. Mitigate quickly by disabling password authentication and enforcing key-based access.
3. Audit Alpine cloud images and default accounts, especially alpine and its doas privileges.
4. Hunt for compromise indicators in SSH logs and investigate suspicious doas activity.
5. Use published tooling to identify exposed systems and enumerate at-risk accounts.