https://seclists.org/oss-sec/2026/q4/539: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 6, 2026
·Updated
Affected Software
2 affected components
OpenSSH OpenSSH<10.6p2
musl musl libc
The issue affects some Linux systems using musl libc when OpenSSH is built and run with PAM support disabled. It is exploitable for accounts whose password hash field is an invalid value of '*' ; Alpine Linux is identified as one affected system.
An attacker needs to target an account with a password hash field of '*'. Supplying a password longer than 257 characters causes musl libc's crypt(3) to return '*', allowing authentication.
Check whether sshd is built and operating with PAM support disabled, whether the host uses musl libc, and whether any account has '*' in its password hash field. All of these conditions are relevant to exploitation.
OpenSSH 10.6p2 includes a fix that avoids the bypass by checking the minimum password-hash length rather than relying on musl crypt(3)'s '*' result.