A critical vulnerability that affects OpenSSH servers on Linux systems built with the musl C library instead of glibc allows remote attackers to easily bypass authentication and log into accounts that should have password authentication disabled. The flaw impacts the lightweight Alpine Linux, which is widely used for cloud Docker container images, as well as Linux distributions for embedded systems.
The security bug, dubbed *SSHole and tracked as CVE-2026-123158, was discovered by Ozgun Kultekin, a researcher with security testing firm Wakefield, and has existed for the past 10 years. The OpenSSH maintainers moved quickly to add mitigation for the flaw in the OpenSSH 10.6p2 emergency update released Thursday, even though they claim the bug is not actually in their code.
“It’s not every day that the ‘exploit’ for a vulnerability in a technology as prevalent as OpenSSH is just ‘send a long password’ or ‘send a lot of A characters,’ but here we are,” said Jake Knott, head of threat intelligence at preemptive exposure management firm watchTowr. “On affected systems, the exploit is strikingly simple: send a password between 257 and 1,024 characters long.”
