https://seclists.org/oss-sec/2026/q4/522: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 5, 2026
·Updated
Affected Software
2 affected components
OpenSSH OpenSSH<10.6p2
musl musl libc
Systems using musl libc are exposed when sshd is built and run with PAM support disabled and password authentication is enabled. Alpine Linux is identified as one affected example.
The attacker needs an account whose password-hash field is exactly '*'. They can authenticate as that account by submitting a password longer than 257 characters.
Set PasswordAuthentication no in /etc/ssh/sshd_config. This mitigates the issue by disabling password-based SSH logins.
Check for accounts with an invalid password-hash field of '*'. Those accounts are susceptible when the other affected conditions are present.