The OpenSSH sshole Vulnerability: Two Different Kinds of 'No Match' Accidentally Matched

The OpenSSH sshole vulnerability, CVE-2026-123158, let a remote attacker log into an account with no password set on Alpine Linux, using nothing but an unusually long password string. According to The Hacker News, threat intelligence firm Previdian observed the first exploitation attempt less than nine hours after the CVE was published, and confirmed successful root access on a honeypot running real Alpine Linux and OpenSSH.

Jump to why this took forty years to notice for the part of this story that's genuinely remarkable.

What the Bug Actually Does

The mechanism, as documented in detail by ox.security's technical analysis, comes down to two unrelated systems independently choosing the same sentinel character to mean "this will never match," then being compared against each other. An account with no password set stores a single asterisk, *, in its password field. Separately, musl's crypt() function, the cryptographic hashing function Alpine Linux's standard library uses, returns that same asterisk when it rejects a password as too long, specifically anything between 257 and 1,024 bytes, a limit musl added in 2012 specifically to prevent denial-of-service attacks from oversized inputs.

When OpenSSH's sshd runs without PAM (Pluggable Authentication Modules), which is how Alpine's default openssh-server package is built, it hashes the submitted password itself and compares the result directly against the stored field. Submit a password long enough to trip musl's length limit, and crypt() returns *. Compare that against a stored field of *, and the strings match. SocRadar's writeup confirms the authentication succeeds on that comparison alone, no actual password required.

Why This Took Forty Years to Notice

The sentinel-collision framing isn't editorializing, it's how the researcher who found the bug, Özgün Kültekin of Wakefield, traces the problem. Sploitus's technical timeline lays out the chain explicitly: Unix adopted * to mean "no password" as far back as 1980's 3BSD documentation. musl, independently, started returning * for a failed crypt() call in 2012, and added the 256-byte length cap, the actual trigger condition, seventeen days later in the same month.

OpenSSH added salt-borrowing logic in 2016 to fix a username-enumeration bug, CVE-2016-6210, which is the piece that lets sshd reach for a real password hash elsewhere on the system to generate a comparison salt in the first place. None of these three changes, made across a span of decades by different maintainers for different reasons, was wrong on its own. The vulnerability only exists where all three intersect.

That's also why reproducing it required brute force rather than code review. ox.security's research describes building sshd in every combination of glibc, musl, PAM, and no-PAM, then firing roughly 17,600 deliberately unusual login attempts at each build. Every combination behaved correctly except exactly one: musl without PAM.

Who Is Actually Exposed

The exposure conditions are narrow but common in one specific context. According to BigGo's reporting, four conditions must all hold simultaneously: the SSH daemon must be built without PAM, password authentication must be enabled (OpenSSH's own default), at least one account must have * in its password field, and at least one other local account must carry a real $5$ or $6$ hash for sshd to borrow a salt from.

Alpine Linux's default openssh-server package satisfies the first condition out of the box. Help Net Security's reporting quotes the researcher listing OpenWrt, Buildroot, and Yocto as other musl-based systems worth checking, "along with a lot of the docker images you've pulled." Debian, Ubuntu, RHEL, and anything else built on glibc are confirmed unaffected; OpenSSH maintainer Damien Miller stated explicitly that glibc-based systems and PAM-authenticated setups fall outside the bug's scope.

What This Means If You Run Alpine-Based Containers or VMs

Our verdict: patch immediately if you're exposed, but recognize that exposure here depends on a narrow, specific configuration, not on simply running Alpine. The honeypot compromise happened in under nine hours, so the window for "patch when convenient" has already closed for anyone reachable on the public internet.

• Upgrade to OpenSSH 10.6p2 or your distribution's patched package, which Alpine has backported all the way to version 3.16 according to SocRadar's version table, then restart sshd. Upgrading the package alone does not restart a running daemon.
• If you can't patch immediately, set PasswordAuthentication no and restart sshd. This was independently verified as an effective mitigation by multiple researchers, and it has the side benefit of closing off password-guessing attacks generally, not just this specific bug.
• Audit for accounts with * in /etc/shadow on any musl-based host, especially cloud-init images where a default "alpine" user with passwordless doas to root is documented as present in official tiny-cloud images. That combination, a passwordless admin account plus any other account with a real password hash, is the exact precondition this bug needs.

FAQ

What is the OpenSSH sshole vulnerability, CVE-2026-123158?

It's a password authentication bypass affecting OpenSSH on Linux systems that use the musl C library without PAM, most notably Alpine Linux's default configuration. An attacker can submit a password between 257 and 1,024 bytes long to an account that has no password set, and musl's crypt() function returns an error value that happens to match the stored "no password" marker, causing sshd to accept the login.

Has CVE-2026-123158 been exploited in the wild?

Yes. According to Previdian's telemetry, as reported by The Hacker News, the first exploitation attempt occurred less than nine hours after the CVE was published, and the firm confirmed successful root access on a honeypot running Alpine Linux and OpenSSH. Telemetry showed a total of eight exploitation attempts from a single IP address.

Does this vulnerability affect Debian, Ubuntu, or Red Hat systems?

No. The bug requires musl libc, which Alpine Linux and a handful of embedded/lightweight distributions use. Standard Ubuntu, Debian, and Red Hat systems are built on glibc and are confirmed unaffected, as is any system where sshd authenticates through PAM instead of its internal password-checking path.

What We Checked Before Publishing

We cross-referenced the vulnerability mechanism across ox.security's and Sploitus's independent technical breakdowns, confirmed the exploitation timeline through The Hacker News' and Help Net Security's reporting of Previdian's telemetry, and verified the affected-versions table against SocRadar's published list of patched Alpine packages. We did not find any outlet confirming exploitation volume beyond Previdian's eight recorded attempts from one IP address, and we've reported that specific, limited figure rather than implying broader in-the-wild activity.

I'm Rohit, founder of Krova Cloud: every Cube ships with key-based SSH access configured from first boot, not password authentication left on by default. That's not a defense against this specific musl-and-no-PAM intersection, our control plane isn't built that way, but it's the same underlying principle this bug illustrates: a default that's convenient in isolation can become a liability the moment it combines with some other default nobody thought to check against it. More debugging stories at debugly.dev.

Structured Data

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "BlogPosting",
      "headline": "The OpenSSH Bug Where Two Different Kinds of 'No Match' Accidentally Matched",
      "datePublished": "2026-11-07",
      "dateModified": "2026-11-07",
      "author": {
        "@type": "Person",
        "name": "Rohit"
      },
      "about": ["OpenSSH sshole vulnerability", "CVE-2026-123158", "Alpine Linux security", "musl libc"]
    },
    {
      "@type": "FAQPage",
      "mainEntity": [
        {
          "@type": "Question",
          "name": "What is the OpenSSH sshole vulnerability, CVE-2026-123158?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "It's a password authentication bypass affecting OpenSSH on Linux systems that use the musl C library without PAM, most notably Alpine Linux's default configuration. An attacker can submit a password between 257 and 1,024 bytes long to an account that has no password set, and musl's crypt() function returns an error value that happens to match the stored 'no password' marker, causing sshd to accept the login."
          }
        },
        {
          "@type": "Question",
          "name": "Has CVE-2026-123158 been exploited in the wild?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Yes. According to Previdian's telemetry, as reported by The Hacker News, the first exploitation attempt occurred less than nine hours after the CVE was published, and the firm confirmed successful root access on a honeypot running Alpine Linux and OpenSSH. Telemetry showed a total of eight exploitation attempts from a single IP address."
          }
        },
        {
          "@type": "Question",
          "name": "Does this vulnerability affect Debian, Ubuntu, or Red Hat systems?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "No. The bug requires musl libc, which Alpine Linux and a handful of embedded/lightweight distributions use. Standard Ubuntu, Debian, and Red Hat systems are built on glibc and are confirmed unaffected, as is any system where sshd authenticates through PAM instead of its internal password-checking path."
          }
        }
      ]
    }
  ]
}