CISAAnalysisCISA issues alert on OpenSSH "sshole" authentication bypass flaw
What happened.Security authorities published vulnerability alerts detailing an actively exploited authentication bypass defect in Portable OpenSSH on musl libc systems nicknamed "sshole".
Why it matters.Secure Shell daemons provide administrative access across infrastructure. When library error conventions mismatch, standard password checks grant access to disabled accounts without credentials. Cloud teams deploying Alpine Linux must upgrade to OpenSSH 10.6p2 and restart daemon processes. Security engineers should mandate public-key authentication and disable password logins across administration endpoints.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-123158 with an 8.1 CVSS score, the flaw impacts OpenSSH prior to 10.6p2 built against musl libc without PAM.
- Input size triggers: The musl crypt function returns an asterisk on passwords over 256 bytes, matching locked account markers in shadow files.
- Root access vector: Attackers sending oversized passwords to locked accounts trigger successful string equality checks, securing administrative command shells.
- Honeypot telemetry: Telemetry confirmed active in-the-wild exploitation against Alpine Linux containers within hours of public disclosure.
- Remediation release: OpenSSH released Portable OpenSSH 10.6p2, with distributions advising operators to disable password authentication or restart sshd.