OpenSSH Flaw *sshole Lets Long Passwords Bypass Disabled Logins
A vulnerability called *sshole (CVE-2026-123158) in OpenSSH lets an attacker log in without the correct password on some systems. Researcher Ozgur Kurtekin of Wakefield published the details on November 5, 2026.
1 source 3h ago
Reporting from 1 source: GIGAZINE.
Why it matters
The bug sits in the gap between OpenSSH and musl libc, where a failed hash computation returns the same asterisk used to mark password login as disabled, so accounts meant to be unreachable can be opened with one long password and one connection.
Key Facts
- The vulnerability is tracked as CVE-2026-123158 and nicknamed *sshole.
- Ozgur Kurtekin of Wakefield published the details on November 5, 2026.
- The flaw affects OpenSSH on systems using musl libc, such as Alpine Linux, without PAM.
- A password of 257 bytes or more can match the asterisk stored for accounts with password login disabled.
- The attack succeeds in one connection and needs another local account with a SHA-256 or SHA-512 hash.
The flaw needs musl libc, no PAM, password authentication enabled, and another local account with a SHA-256 or SHA-512 hash. A password of 257 bytes or more then matches the disabled account's stored asterisk.
The attack needs a specific stack. Alpine Linux and similar systems use musl libc, whose crypt() function returns "*" when hashing fails, and SHA-256 or SHA-512 hashing fails on passwords longer than 256 bytes. OpenSSH compares that result to the stored hash under some conditions, so a 257 byte password against an account marked "*" matches.
Alpine's advisory lists the remaining conditions: password authentication enabled, PAM not in use, and a second local account with a valid SHA-256 or SHA-512 hash. The attack takes a single connection, with no repeated password attempts, and a password between 257 and 1024 bytes.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google