OpenSSH flaw affects musl Linux
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
OpenSSH released version 10.6p2 after researcher Ozgun Kultekin detailed a flaw in musl-based Linux systems.
Alpine cloud images with a default passwordless account could be exposed to root access.
Background
OpenSSH is the widely used SSH server project for remote logins; musl is a lightweight C library common in embedded Linux and standard on Alpine Linux, which ships official AWS and Azure cloud images. The flaw, dubbed "*sshole" and tracked as CVE-2026-123158, stems from how OpenSSH handles password verification errors on musl systems, letting attackers log into accounts whose passwords are disabled. It only affects servers with PAM authentication disabled, SSH password authentication enabled, at least one account with an asterisk as its password hash and another with a valid hash; glibc-based distributions like Debian, Ubuntu and Fedora are not vulnerable. OpenSSH and Alpine moved fast partly because they fear malicious actors could find the bug soon with AI assistance.
How it unfolded
- 2016A patch for the username-enumeration flaw CVE-2016-6210 changed how OpenSSH handled accounts without usable password hashes, making it hash passwords even for accounts marked with an asterisk.
- Nov 4, 2026The OpenSSH project learned of the issue when an employee of AI security company Wakefield reported it.
- Nov 5, 2026Researcher Ozgun Kultekin released details of the vulnerability, dubbed "*sshole".
- Nov 5, 2026OpenSSH released version 10.6p2 to fix the flaw; the update was already available for Alpine, while other distributions and many OpenSSH download servers still offered 10.6p1.
- Nov 5, 2026Alpine pushed the fix to every branch back to 3.16, including releases no longer supported.
- Nov 5, 2026The flaw was tracked as CVE-2026-123158 with a CVSS v3.1 score of 8.1, rated High. Kultekin said he found it using AI agents that ran about 17,600 authentication tests.
Key terms
- musl
- A lightweight C standard library for Linux-based systems, released under the MIT license and aimed at embedded and mobile devices.
- PAM authentication
- A mechanism that integrates multiple low-level authentication schemes into a high-level API, letting programs authenticate independently of the underlying scheme.
- glibc
- The GNU Project's implementation of the C standard library, providing a wrapper around Linux kernel system calls.
Source: Wikipedia
Who’s saying what
- Expert
- Kultekin says the flaw has existed since 2016 and that Alpine's official AWS and Azure cloud images have an affected default 'alpine' account with passwordless 'doas' privileges, which could allow attackers to gain root access.
- Official
- OpenSSH developer Damien Miller urged users of affected systems to disable password-based login immediately or disable SSH altogether for now; Alpine developers published the same warning.
- Caution
- OpenSSH developers believe the problem does not originate in OpenSSH itself but released a new version quickly to mitigate it, and both projects moved fast fearing malicious actors could find the bug soon with AI assistance.
Still unverified
No exploitation has been reported. OpenSSH developers believe the problem does not originate in OpenSSH itself. The CVE-2026-123158 tracking number appears in one report.