*sshole: OpenSSH bypass hits Alpine Linux servers, fix in 10.6p2

A long enough password opens accounts that have no password. A newly disclosed OpenSSH password bypass, nicknamed "*sshole," lets an attacker log into key-only accounts on Alpine Linux and other musl-based systems by sending a password of 257 to 1,024 bytes. Alpine Linux's advisory is blunt: one connection, works every time. The fix is in OpenSSH 10.6p2, tracked as CVE-2026-123158 (CVSS 8.1).

What actually happened

Researcher Ozgun Kultekin disclosed the bug on November 5, BleepingComputer reported. He found it with AI agents that ran about 17,600 authentication tests.

• The root cause. A 2016 OpenSSH change hashes passwords even for accounts with no usable hash, to stop username probing. On musl, crypt() returns * when hashing fails, including on an oversized password. A key-only account's stored hash is also *. They match. You're in.
• Who's exposed. Alpine's default openssh-server package, built without PAM, with PasswordAuthentication yes (the OpenSSH default). You also need one account with a * password field and one account with a real $5$ or $6$ hash. Alpine says every release it checked, 3.16 through 3.24 and edge, is affected.
• The root risk. Official Alpine tiny-cloud images ship an alpine user with a * password and passwordless doas. Alpine says they're safe on first boot. They become exploitable once any real password hash exists on the box, and then an attacker can reach root.
• Not affected. glibc distros like Debian, Ubuntu and Fedora. PAM setups with UsePAM yes. Containers that don't run sshd. Hosts with password auth off.

Why it matters for your business

Alpine is everywhere small teams cut costs: lean VMs, routers, build boxes, the one-off server a contractor set up in 2021. Nobody remembers it runs sshd. That's the box that gets you.

Do this today:

1. Update and restart. apk upgrade -U -a, then rc-service sshd restart. Alpine notes the upgrade alone doesn't replace the running daemon.
2. Turn off password logins. PasswordAuthentication no. Keys only. Test a key login before you close your session.
3. Check for a break-in. Search /var/log/messages for Accepted password on alpine, root or any key-only user. If you find one, treat the machine as compromised.
4. Inventory your images. Know which hosts run Alpine, OpenWrt or other musl builds, and who owns them.

Sources: Alpine Linux, BleepingComputer, CVE-2026-123158.