AI Agent UpdateOpenSSH “*sshole” flaw lets oversized passwords log into password-disabled accounts
OpenSSH released an emergency fix on November 5 for a flaw dubbed “*sshole” that lets an attacker log into password-disabled accounts on Alpine Linux and other musl-based systems with an oversized password — a bug that has existed since 2016.
The News
OpenSSH released emergency fix 10.6p2 on November 5, 2026, for a password-authentication bypass dubbed “*sshole” — CVE-2026-123158, rated 8.1 out of 10 — disclosed by researcher Özgün Kültekin of Wakefield. On musl libc systems running OpenSSH without PAM, the password-checking function returns “*” when a password exceeds 256 bytes, and “*” is also what is stored for accounts configured with no usable password, such as key-only accounts. A password of 257 to 1,024 bytes therefore matches the stored “*”, logging the attacker in with no credentials at all.
The conditions are specific, but the exposure is wide. The flaw affects Alpine Linux — whose standard OpenSSH server package is built without PAM — plus OpenWrt, Buildroot and Yocto, and it requires password authentication to be enabled, at least one account with a “*” hash, and at least one other account with a normal password hash whose salt the server borrows. Alpine’s official tiny-cloud images, versions 3.18.11 to 3.24.3, ship an “alpine” account with a “*” password and passwordless administrator access, making a successful login equal to root — but only once an account with a $5$ or $6$ password hash exists on the machine; the images are safe on first boot. Alpine has shipped patched openssh packages — 10.3_p1-r2 for Alpine 3.24, 10.2_p1-r1 for 3.23, 10.0_p1-r11 for 3.22 and 9.9_p2-r1 for 3.21 (10.6_p2-r0 on edge). Systems using the glibc library — Debian, Ubuntu, Fedora — and servers using PAM authentication are not affected.
The flaw became dangerous in 2016, when a fix for an earlier username-enumeration bug changed how OpenSSH handles accounts without usable passwords — combined with musl’s “*” behaviour, which dates to 2012. No confirmed exploitation in the wild has been reported as of November 6, though watchTowr reports active exploitation attempts; proof-of-concept material is referenced in the CVE record, and the flaw is not in CISA’s Known Exploited Vulnerabilities catalog. The researcher says he surfaced the bug with AI agents running about 17,600 login tests — his account, not independently verified. The same day’s market tape was brutal for security vendors for unrelated reasons: CrowdStrike closed at $217.20, down 9.9%, and Palo Alto Networks at $314.67, down 9.6%, in the broad AI-trade unwind, with no company news behind either drop.
A password longer than 256 bytes logs you in with no credentials — a ten-year-old bug hiding in the world’s most-used remote-login software.
Why It Matters
OpenSSH is the front door to most of the internet’s servers, and a bypass in it is a different class of problem from a flaw in an app. The conditions are narrow — musl, no PAM, password authentication on, a “*” account present — but Alpine Linux is the default small Linux for containers, which means the narrow condition describes a very large number of machines, many of them running unattended. The tiny-cloud images are the worst case: an account with a “*” password and passwordless administrator access means a successful login is root, not a foothold.
It matters because of the ten years. A bug introduced by a security fix in 2016 survived a decade of audits of one of the most scrutinised codebases in open source, and it was found by a researcher using AI agents to run 17,600 login tests. That is a new shape of vulnerability research — automated, relentless, cheap — and it cuts both ways: defenders will find more old bugs this way, and so will attackers. The fix is out and the proof of concept is public, so the clock is running. Every unpatched Alpine box is now a known quantity, and the only question is who gets to it first.
Analyst's Take
Our call is Bearish — for the unpatched, which is the only honest way to call a vulnerability story. The flaw is real, the fix exists, and the gap between those two facts is where the damage happens. Alpine is the container world’s favourite small Linux, which means the affected systems are everywhere and often unloved: tiny cloud images, build machines, embedded devices, the infrastructure nobody patches on a Friday. A 257-byte password is not a sophisticated attack; it is a typo that works.
What to do is simple and urgent: upgrade to OpenSSH 10.6p2, or to Alpine’s patched packages, and check for an “alpine” account with a “*” password on any tiny-cloud image. The ten-year lifetime is the real story — a bug introduced by a security fix in 2016, sitting in one of the most audited codebases on earth, found by a researcher running AI agents through 17,600 login attempts. If that is how a decade-old bypass gets found, the next one is already being looked for. Patch first, read the write-up after.
By The Numbers
FAQ
What is OpenSSH, in plain terms?
The software that lets administrators log into a server over the network securely — the standard way to manage Linux servers remotely. If it has a flaw, every server running it is potentially affected.
What is musl, and why does it matter here?
musl is a small, lightweight version of the C library — the basic code every program on a Linux system uses. Alpine Linux, a popular choice for containers and small servers, uses musl instead of the more common glibc. The flaw only affects musl systems running OpenSSH without PAM, the usual authentication framework.
How does an oversized password log someone in?
On musl systems, the password-checking function returns “*” when a password is longer than 256 bytes — and “*” is also what is stored for accounts configured with no usable password, like key-only accounts. A password of 257 to 1,024 bytes therefore matches the stored “*”, and the attacker is logged in with no credentials.
Am I affected?
Only if you run OpenSSH without PAM on a musl system — Alpine Linux, OpenWrt, Buildroot or Yocto — with password authentication enabled and at least one account with a “*” password. Debian, Ubuntu, Fedora and other glibc systems are not affected, and neither are servers using PAM. Alpine’s official tiny-cloud images ship an “alpine” account with a “*” password and passwordless administrator access, making a successful login equal to root.
Has anyone used this in an attack?
No confirmed exploitation in the wild has been reported as of November 6, though watchTowr reports active exploitation attempts; proof-of-concept material is referenced in the CVE record. The fix is OpenSSH 10.6p2, released November 5, and Alpine has shipped patched packages. The researcher says he surfaced the bug with AI agents running about 17,600 login tests — his account, not independently verified.
👁
Source: BleepingComputer / OpenSSH / Alpine Linux