OpenSSH: Password authentication bypass (CVE-2026-123158)

CVE-2026-123158, dubbed "SSHhole," is an authentication bypass vulnerability in OpenSSH. The vulnerability stems from an interaction between the musl libc crypt() function and OpenSSH password verification logic. When an attacker provides a password between 256 and 1024 characters, crypt() may return an asterisk * as an error indicator. If an account is configured with * as its stored password hash (commonly used for disabled or key-only accounts), the OpenSSH authentication routine may interpret the match as successful, granting unauthorized access.

Attack Chain

1. Attacker identifies an OpenSSH target running on a musl libc-based Linux distribution without PAM.
2. Attacker enumerates accounts configured for key-only authentication (often identified by * in the shadow file).
3. Attacker initiates an SSH password authentication attempt.
4. Attacker provides a crafted password string between 256 and 1024 characters.
5. The target's crypt() function returns * due to length overflow.
6. OpenSSH logic compares the returned * with the account's stored * hash.
7. OpenSSH erroneously confirms the password match.
8. Attacker gains unauthorized access to the target account.

Impact

Successful exploitation allows for unauthorized SSH access to affected accounts. The level of access gained depends on the privileges of the targeted account.

Recommendation

• Upgrade to OpenSSH 10.6p2 or later immediately to resolve the authentication logic flaw.
• Disable password authentication on systems where it is not strictly required by setting PasswordAuthentication no in sshd_config.
• Inventory systems using musl libc to identify high-risk assets, particularly Alpine Linux and embedded device environments.
• Audit SSH logs for unexpected successful password authentication events, specifically for accounts normally restricted to SSH keys.