{"id":4117,"date":"2026-11-10T09:50:31","date_gmt":"2026-11-10T17:50:31","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=4117"},"modified":"2026-11-10T09:50:31","modified_gmt":"2026-11-10T17:50:31","slug":"openssh-sshole-cve-2026-123158-alpine-musl-password-bypass","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/openssh-sshole-cve-2026-123158-alpine-musl-password-bypass\/","title":{"rendered":"La faille \u201c sshole \u201d d'OpenSSH (CVE-2026-123158) : des mots de passe trop longs permettent de se connecter \u00e0 Alpine et musl Linux, une vuln\u00e9rabilit\u00e9 d\u00e9sormais exploit\u00e9e."},"content":{"rendered":"\n

Attackers are logging in to Alpine Linux and other musl-based systems over SSH without knowing any password. The flaw, nicknamed \u201csshole\u201d and tracked as CVE-2026-123158, lets a password of 257 to 1,024 bytes unlock accounts whose password field is just an asterisk. OpenSSH shipped a fix on 5 November, the first exploitation attempt against a honeypot was reported within hours, and on 9 November CISA added the bug to its Known Exploited Vulnerabilities (KEV) catalog with a federal deadline of 12 November.<\/p>\n\n\n\n

CVE<\/strong><\/td>CVE-2026-123158 (CWE-394, unexpected return value)<\/td><\/tr>
Affected<\/strong><\/td>sshd on Linux built with musl libc and without PAM<\/strong> (Alpine\u2019s openssh-server<\/code>, or openssh-server-pam<\/code> with UsePAM no<\/code>)<\/td><\/tr>
Fixed in<\/strong><\/td>OpenSSH 10.6p2 upstream; Alpine packages for every branch from 3.16 to edge (table below)<\/td><\/tr>
Exploited<\/strong><\/td>Yes. CISA KEV, honeypot root access reported, botnet and cryptominer activity reported<\/td><\/tr>
Deadline<\/strong><\/td>Added to KEV 9 Nov 2026, federal due date 12 Nov 2026<\/strong>, forensic triage flagged<\/td><\/tr>
Workaround<\/strong><\/td>PasswordAuthentication no<\/code>, or disable SSH on the host<\/td><\/tr>
CVSS<\/strong><\/td>Not verified (no vendor or NVD score confirmed at press time)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What happened<\/h2>\n\n\n\n

OpenSSH 10.6p2, released on 5 November 2026, includes an sshd change to avoid a password-authentication bypass on some Linux systems built and run without PAM. The project describes it as a critical workaround for Linux systems that combine the musl C library with PAM disabled, and notes that the root cause sits outside sshd itself (OpenSSH release notes<\/a>). Alpine Linux published its own advisory the same day (Alpine advisory<\/a>).<\/p>\n\n\n\n

Exploitation followed almost immediately. Previdian reported a first attempt less than nine hours after the CVE was published and confirmed that the attacker reached root on an Alpine honeypot (Help Net Security<\/a>); that timing is a single-source claim. SecurityWeek reported on 9 November that botnets and cryptominers are now using the flaw (SecurityWeek<\/a>). The same day, CISA added CVE-2026-123158 to KEV, describing it as an unexpected return value that could allow authentication bypass, with a three-day due date and a forensic-triage requirement (CISA KEV<\/a>). OpenSSH\u2019s Damien Miller urged affected users to switch off password authentication or disable SSH immediately rather than wait for a maintenance window (Help Net Security<\/a>).<\/p>\n\n\n\n

Who is affected<\/h2>\n\n\n\n

Alpine is precise about the conditions. A host is exploitable only when all<\/strong> of the following are true (Alpine advisory<\/a>):<\/p>\n\n\n\n

    \n
  1. sshd is the openssh-server<\/code> package built without PAM, or openssh-server-pam<\/code> running with UsePAM no<\/code>;<\/li>\n\n\n
  2. PasswordAuthentication yes<\/code> is in effect, which is the default;<\/li>\n\n\n
  3. a target account has *<\/code> in its password field;<\/li>\n\n\n
  4. another local account has a $5$<\/code> or $6$<\/code> password hash;<\/li>\n\n\n
  5. the attacker sends a password between 257 and 1,024 bytes long.<\/li>\n\n<\/ol>\n\n\n\n

    Hosts are not<\/strong> affected if they run openssh-server-pam<\/code> with UsePAM yes<\/code>, have password authentication disabled, lock accounts with !<\/code> rather than *<\/code>, have no $<\/code>-style hashes, or are containers that never start sshd. Root logins are protected by the default PermitRootLogin prohibit-password<\/code>, unless another login-capable account can escalate, for example through doas<\/code>.<\/p>\n\n\n\n

    Alpine says its affected tiny-cloud images run from 3.18.11 to 3.24.3, and the fixed point releases are 3.21.10, 3.22.8, 3.23.8 and 3.24.4. According to SOCRadar, as reported by Help Net Security, those AWS and Azure tiny-cloud images also ship a default alpine<\/code> user with passwordless doas<\/code>, which turns a non-root login into root (Help Net Security<\/a>).<\/p>\n\n\n\n

    Alpine branch<\/th>Fixed openssh<\/code> package<\/th><\/tr><\/thead>
    edge<\/td>10.6_p2-r0<\/td><\/tr>
    3.24<\/td>10.3_p1-r2<\/td><\/tr>
    3.23<\/td>10.2_p1-r1<\/td><\/tr>
    3.22<\/td>10.0_p1-r11<\/td><\/tr>
    3.21<\/td>9.9_p2-r1<\/td><\/tr>
    3.20<\/td>9.7_p1-r6<\/td><\/tr>
    3.19<\/td>9.6_p1-r3<\/td><\/tr>
    3.18<\/td>9.3_p2-r4<\/td><\/tr>
    3.17<\/td>9.1_p1-r7<\/td><\/tr>
    3.16<\/td>9.0_p1-r6<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Source: Alpine advisory<\/a>.<\/em><\/p>\n\n\n\n

    The researcher behind the finding, \u00d6zg\u00fcn K\u00fcltekin of Wakefield, also names OpenWrt, Buildroot, Yocto and many Docker images as musl-based systems worth checking. Debian, Ubuntu, Fedora, Dropbear and OpenBSD are reported as not affected (Help Net Security<\/a>). MAG212 CYBER analysis:<\/strong> the biggest real-world exposure is Alpine-based containers and VMs that run sshd, plus embedded builds. Many OpenWrt-based routers and access points use Dropbear rather than OpenSSH, so check each vendor rather than assume either way; we found no network-vendor advisory at press time.<\/p>\n\n\n\n

    How the attack works<\/h2>\n\n\n\n

    Without PAM, sshd checks each password attempt by hashing it with crypt()<\/code>. When an account\u2019s stored field is too short to contain a salt, sshd borrows another account\u2019s salt so the comparison still runs. Alpine explains that musl\u2019s crypt()<\/code> fails on keys longer than 256 bytes and returns the string *<\/code>. If the target account\u2019s stored password field is also *<\/code>, the two match and sshd accepts the login (Alpine advisory<\/a>).<\/p>\n\n\n\n

    \"Diagram
    How the sshole bypass works, and the five conditions that must all be true (based on the Alpine advisory). Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

    In Previdian\u2019s honeypot the attacker ran id<\/code>, uname<\/code> and hostname<\/code> after logging in, the usual first look around (Help Net Security<\/a>). We do not yet know how many hosts are exposed worldwide or what payloads attackers deploy beyond the botnet and cryptominer activity SecurityWeek reported.<\/p>\n\n\n\n

    What to look for<\/h2>\n\n\n\n