Title: SSHole: OpenSSH Flaw Lets Long Passwords Bypass Auth into Passwordless Accounts
Summary:
A newly disclosed OpenSSH flaw, tracked as CVE-2026-123158 (CVSS 8.1) and codenamed SSHole, lets an unauthenticated attacker sign in to any account whose password field is * — meaning no password is set, the normal state for key-only accounts. The attacker sends an oversized password (257 to 1,024 bytes); on musl C-library systems where sshd handles passwords without PAM, a failed hash of that key returns the literal string *, which then matches the stored “disabled password” marker. The default Alpine openssh-server configuration is affected — root ships as root:* in the base image, and official tiny-cloud images ship an alpine user with a * field and passwordless doas — while glibc-based distributions, PAM-based setups, and Dropbear are not. Exploitation is not theoretical: Previdian saw the first attempt under nine hours after the CVE was published and confirmed root access on an Alpine honeypot; by November 8 it had recorded 20 attempts from 13 distinct IPs. The fix is in OpenSSH 10.6p2, with patched Alpine packages published back to 3.16 — after upgrading, restart sshd, since the running daemon keeps the old behavior — or set PasswordAuthentication no as a stopgap. Alpine also advises checking logs for Accepted password for lines against accounts that should not accept passwords and treating exposed machines as compromised if one cannot be ruled out.
References: