https://seclists.org/oss-sec/2026/q4/533: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 5, 2026
·Updated
Affected Software
2 affected components
OpenSSH OpenSSH
musl musl libc
It says crypt_r, crypt_rn, and crypt_ra write an invalid hash to their output field, while crypt writes one to static storage. The invalid hash is shorter than 13 characters, begins with '*', and does not compare equal to the supplied setting.
No. It names OpenSSH and musl libc but provides no version range, affected configuration details, exploitation prerequisites, detection method, or mitigation guidance.