OpenSSH's 'SSHole' Bug Let Hackers Log In With No Password

Send a web server a password that's 300 bytes long instead of 30, and on certain Linux systems, OpenSSH will let you straight in — no password required. That's the bug researchers are calling "SSHole," and within hours of it becoming public, someone was already trying it on a honeypot.

What actually broke

The flaw, tracked as CVE-2026-123158 and rated 8.1 out of 10 on the standard severity scale (high, not quite the maximum "critical"), lives in how OpenSSH's login process (sshd) talks to musl, the lightweight C library used instead of glibc on Alpine Linux and similar distributions, when that system wasn't built with PAM — the pluggable login-checking framework most mainstream Linux distros rely on for password verification. Send it an oversized password — researchers found the sweet spot is somewhere between 257 and 1,024 bytes — and musl's password-checking function chokes and returns a plain asterisk. In the Unix password file format, an asterisk in that field has always meant "this account has no password set." sshd reads that signal at face value and waves the login through.

It's not a free-for-all. The attack needs password logins turned on in the first place, an account on the box that genuinely has no password configured, and at least one other account with a real password hash for sshd to borrow a cryptographic salt from while it's getting confused. Getting all the way to root additionally needs root login to be allowed over SSH, which most sane setups disable anyway. Still, that's a lower bar than it sounds like on a lot of quickly-spun-up servers and containers.

Why the "just Alpine" caveat doesn't make this niche

Alpine Linux doesn't get much attention compared to Ubuntu or Debian, but it's the default base image for an enormous share of Docker containers worldwide, precisely because it's tiny and starts fast. If you've ever pulled a container image and seen "alpine" in the Dockerfile, you've used it. That's what makes this more than a footnote: a bug that sounds exotic ("musl, no PAM, specific distro") sits underneath one of the most common building blocks in modern software deployment.

A bug that only "technically" affects one C library still affects everyone who built their infrastructure on top of it without checking.

Researcher Özgün Kültekin is credited with first flagging the issue, and OpenSSH shipped a fix — version 10.6p2 — on November 5. Security firms have split on how far exploitation has actually spread: one threat-intel outfit says it caught an exploitation attempt against a honeypot within nine hours of disclosure and confirmed root access; another firm says it hadn't seen confirmed real-world exploitation as of the same date, even though working proof-of-concept code is already circulating publicly. Either way, the patch window is the part that matters now, not the debate over exactly how many attackers have used it.

Why this matters here, not just abroad

India runs an outsized share of the world's backend infrastructure — a huge number of SaaS products, fintech backends, and e-commerce platforms built by Indian startups and IT services firms run on exactly this kind of lightweight, container-first stack to keep cloud bills down. If your DevOps team pulls Alpine-based images in CI/CD pipelines or runs them in Kubernetes clusters, this isn't background noise from a foreign security blog — it's a patch-today item. It's also a reminder of how fast these things move: Code24 covered a different SSH-related scare just last week, when a tampered Claude Code extension planted an SSH backdoor on developer machines, and the pattern is the same — access control, the thing meant to keep attackers out, becoming the hole they walk through.

There's a compliance angle too. Under CERT-In's 2022 directions, Indian organisations are required to report qualifying cybersecurity incidents to the government's nodal cyber agency within six hours of noticing them — not six hours of confirming a breach, six hours of noticing something's off. A silent authentication bypass sitting on internet-facing infrastructure is exactly the kind of thing that clock applies to, and most teams don't find out they were exposed until well after an attacker has been and gone.

What to actually do about it

• Upgrade OpenSSH to 10.6p2 or your distribution's patched package, then restart sshd — the fix doesn't apply itself.
• If you can't patch immediately, set PasswordAuthentication no in sshd_config and rely on SSH keys, which sidesteps the bug entirely.
• Audit for any accounts with no password set, especially default or leftover accounts from base container images — they shouldn't exist on a production box regardless of this CVE.
• Check which of your container images are Alpine-based and confirm whether they were built with or without PAM support before assuming you're in the clear.

None of this required a sophisticated zero-day chain or nation-state tooling — just a password field that was a few hundred bytes too long and a library that handled the edge case badly. That's usually how the worst bugs look in hindsight: small, almost boring, and sitting in a place nobody thought to double-check.