OpenSSH has issued urgent updates to patch a severe vulnerability known as SSHole, identified as CVE-2026-123158, with a CVSS score of 8.1. This flaw could allow unauthorized access using unusually long passwords, posing a significant threat to systems running OpenSSH servers on Linux distributions that utilize the musl libc without the Pluggable Authentication Module (PAM).
Understanding the SSHole Vulnerability
The SSHole vulnerability arises from a misinterpretation of password hashes, permitting access with passwords ranging from 257 to 1,024 characters. While certain accounts, notably root, are not typically password-protected, distributions such as Alpine, OpenWrt, Buildroot, and Yocto are affected, according to security researcher Özgün Kültekin.
OpenSSH developer Damien Miller clarified that though the issue isn’t inherent to sshd, it can still be exploited through it. The necessary fixes have been incorporated into OpenSSH version 10.6p2. Miller emphasized the urgency of this release, noting the rapid bug rediscovery by AI, which shortens the safe embargo period and poses risks if not addressed swiftly.
Immediate Actions Recommended by Alpine Linux
Alpine Linux has advised users to apply the latest OpenSSH patches and restart sshd to replace the active daemon. Alternatively, disabling password logins and restarting sshd is recommended. The vulnerability requires attackers to know an account without a password set, alongside another account possessing a $5$ or $6$ hashed password.
Since version 3.16, Alpine Linux has used “*” for root account security, with $5$ or $6$ indicating SHA-256 or SHA-512 crypt usage. The flaw allows attackers with SSH port access to log in without a valid password, requiring only a single connection attempt.
Potential Impact and Future Security Measures
The vulnerability affects Alpine Linux versions 3.16 to 3.24, including edge releases, as well as older versions no longer receiving updates. Detectify’s Fredrik Almroth noted the ease with which attackers could exploit this flaw, pointing to the vast number of systems with open SSH ports.
Security experts, including WatchTowr’s Jake Knott, anticipate imminent brute-force attempts by attackers. Organizations are advised to update systems promptly and consider disabling password-based authentication as a temporary measure. With the public details available, the risk of exploitation is high, necessitating immediate action to protect vulnerable systems.
This incident underscores the importance of timely updates and proactive security measures to safeguard against emerging threats.
