Threat watch / Vulnerability
"sshole": OpenSSH on Alpine Linux accepts any long password for locked accounts
On musl-based Linux systems such as Alpine, OpenSSH without PAM let an attacker log in to an account whose password field is "*" with any password longer than 256 bytes. OpenSSH 10.6p2 and Alpine packages fixed it on November 5. A researcher saw attempts within nine hours, and root access on one of its honeypots.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- OpenSSH, Alpine Linux
- How it happened
- When the password is longer than 256 bytes, musl's crypt() returns "*" as its error value, which matches the stored "*" of a locked account. It needs the default openssh-server without PAM, PasswordAuthentication enabled, and an account with "*" as its password field. Alpine 3.16 through 3.24 and edge are affected; other musl systems (OpenWrt, Buildroot, Yocto, many Docker images) should be checked. Debian, Ubuntu and Fedora are not affected.[1][2][3] Checked 9 Nov 2026
- What was stolen
- Not public yet Checked 9 Nov 2026
- Who was impacted
- Not public yet Checked 9 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-123158
Timeline
- Alpine publishes its advisory and fixed packages for every branch from 3.16 to edge; OpenSSH releases 10.6p2. The flaw was found by Özgün Kültekin of Wakefield. Updating is not enough: sshd must be restarted. [2][4]
- Detectify says it is not aware of public reports of exploitation as of 15:30 CET. [2]
- Previdian says its first observed attempt came less than nine hours after the CVE was published: eight attempts from a single address in Japan, and confirmed root access on one of its honeypots running real Alpine and OpenSSH. CISA has not added the flaw to its KEV list. [3]
- GreyNoise records its first successful exploitation at 00:46 UTC, about 40 hours after the fix, and then 16 successful exploitation chains against networks it protects, from six addresses. Attackers try to read password hashes and root SSH keys and edit authorized_keys; one gets root and installs a Python remote-control agent. No group is named. [5]