The One-Star SSH Bug That Opened Alpine Servers

Unusually long SSH passwords could authenticate to accounts configured not to accept password logins, potentially including root, on vulnerable Alpine Linux Linux servers. This bypass occurred under a narrow set of conditions, granting access despite explicit security configurations.

Linux shadow entries normally use an asterisk (*) to disable password-based logins for an account. An ordinary password hash should never match this marker, preventing unauthorized access. This mechanism is a standard safeguard against direct password authentication.

The vulnerability is not a universal OpenSSH flaw. An Alpine Linux Linux installation is at risk only when specific authentication and account conditions are present. These include running musl libc, OpenSSH built without PAM, and PasswordAuthentication yes enabled.

Specifically, any password between 257 bytes (musl’s failure threshold) and 1,024 bytes (OpenSSH’s internal maximum) could trigger the bypass. OpenSSH’s lead developer shipped a fix within 24 hours of discovery, acknowledging the speed of AI-driven bug rediscovery.

This CVE-2026-123158 vulnerability requires multiple prerequisites:

• Linux running musl libc (e.g., Alpine Linux Linux)
• OpenSSH built without PAM (UsePAM no)
• PasswordAuthentication yes explicitly enabled
• Target account password field locked with * (e.g., root)
• At least one other active local account with a real $5$ or $6$ shadow hash for salt borrowing.

OpenSSH implements a timing-attack defense: for invalid or locked accounts, it still performs password-hash work. This borrows settings from another local account, revealing less about username existence. However, this defense exposed a critical vulnerability on Alpine Linux Linux systems.

Musl’s crypt() implementation, used by Alpine Linux, returns a single asterisk (*) when hashing an overlong input fails. OpenSSH then compares this failure marker to a locked account’s password field, which also contains a single asterisk. This collision results in an unexpected match, granting authentication.

Researchers reported a password range of 257–1,024 bytes triggers the bypass. This requires musl, PasswordAuthentication yes, a locked target account, and an active $5$ or $6$ shadow hash on another account for OpenSSH to borrow a valid salt.

Crucially, the system must run without PAM (UsePAM no), which is Alpine Linux’s default OpenSSH configuration. This specific combination of factors, discovered by AI agents, enabled authentication to accounts like root that should reject password logins.

Researcher Özgün Kültekin uncovered the vulnerability using automated testing, deploying AI agents to probe approximately 17,600 unusual login configurations and build combinations. Only the specific musl, non-PAM setup on Alpine Linux Linux produced the reported authentication bypass, highlighting the challenge of inter-library interactions.

The discovery prompted an immediate response. OpenSSH lead developer Damien Miller confirmed a fix shipped rapidly, without an embargo. Miller cited concerns that AI agents could independently rediscover such bugs within hours, necessitating a swift public patch.

While AI agents accelerated the search across a vast test matrix, the core lesson emphasizes systematic edge-case testing. This approach is crucial for exposing complex interactions between standard C libraries like musl, authentication systems, and OpenSSH’s codebase. For further technical details, see the *sshole Vulnerability Disclosure.

This bug, CVE-2026-123158, demonstrated how a specific failure mode in musl’s crypt() function, returning an asterisk (*) for overly long passwords, could align with an account’s disabled password (*) in /etc/shadow. This created an unexpected match, allowing unauthorized access.

Install the patched OpenSSH package from your distribution immediately, then restart the sshd daemon. Upgrading package files alone does not update the running daemon; a restart ensures the fix takes effect.

For systems awaiting a patch, set PasswordAuthentication no in sshd_config and restart SSH. Confirm administrators retain a safe alternative, such as key-based access, before disabling password authentication. This prevents the vulnerability from being exploited.

Prioritize internet-facing Alpine Linux Linux servers, jump boxes, and network appliances. Also secure development VMs with active sshd instances. These systems represent the highest risk for unauthorized access.

Most Alpine Linux Linux application containers do not run an SSH daemon. Therefore, image presence alone does not establish exposure; verify sshd is actively running within the container before applying mitigations. This narrows the scope of affected systems.

The vulnerability requires Alpine Linux Linux with the musl C library and no PAM, plus password logins switched on. Debian, Ubuntu, and Red Hat distributions are unaffected. The fix addresses the musl crypt() implementation's return of * on failure, which previously matched locked account entries.

What is the sshhole vulnerability?

It is an OpenSSH authentication bypass in certain musl-based, non-PAM Linux configurations. An overlong password could produce a result that matched a locked account’s asterisk marker.

Which systems may be affected?

The reported conditions include musl libc, OpenSSH built without PAM, password authentication enabled, a locked target account, and a suitable active password hash on the system.

How can administrators mitigate the risk?

Install the distribution’s patched OpenSSH package and restart sshd. If patching is delayed, disable password authentication and restart the daemon.

Are Debian and Ubuntu affected?

The reported flaw depends on a specific musl and non-PAM configuration, so typical Debian and Ubuntu OpenSSH installations are not affected.