https://seclists.org/oss-sec/2026/q4/566: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 6, 2026
·Updated
Affected Software
2 affected components
OpenSSH OpenSSH
musl musl libc
The report identifies OpenSSH used with musl libc. It does not provide affected versions, distributions, or configuration details.
The issue concerns handling of crypt() failures during password authentication. The provided information does not state an attacker prerequisite, exploit steps, or whether default configurations are affected.
Determine whether the OpenSSH deployment is linked against musl libc and whether password authentication is enabled. The report does not provide a definitive detection method or workaround.