OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)
OpenSSH contains a critical flaw, prompting an urgent need for a fix.
OpenSSH has a flaw rated critical -- the kind of severity that moves a fix from the to-do list to today's priority.
This requires local or already-authenticated access to reach.
A newly disclosed flaw involving OpenSSH and musl, dubbed *sshole, allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.
Security researcher Ozgun Kultekin, who discovered and released details on the vulnerability today, says the flaw has existed since 2016 and stems from how OpenSSH handles password verification errors on systems using the musl C library.
The researcher warns that Alpine Linux's official AWS and Azure cloud images have an affected default 'alpine' account with passwordless 'doas' privileges, which could allow attackers to gain root access.
Kultekin says he discovered the vulnerability using AI agents that ran about 17,600 authentication tests with different OpenSSH configurations, malformed password hashes, and oversized passwords.
Anyone running OpenSSH is exposed, specifically wherever OpenSSH is actually deployed rather than just licensed or installed somewhere unused.
The flaw only affects OpenSSH servers running on Linux distributions that use the musl C library, including Alpine Linux, OpenWrt, Buildroot, and Yocto, under certain authentication configurations.
Linux accounts can be configured to prevent password logins by replacing their password hash with an asterisk (*) in the /etc/shadow file.
What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.
Because this is not a valid password hash, no password should allow access to those accounts.
This means an attacker can submit an oversized password and cause OpenSSH to compare the returned * against the account's stored *, resulting in a successful login.
This is tracked as CVE-2016-6210 and rated critical severity, which is the identifier to use when checking vendor guidance.
However, a patch introduced in OpenSSH in 2016 to fix a username enumeration vulnerability tracked as CVE-2016-6210 changed how OpenSSH handled accounts without usable password hashes.
Systems using glibc, including Debian, Ubuntu, and Fedora, and those using PAM authentication are not vulnerable to this attack.
To prevent attackers from identifying valid usernames through different response times, OpenSSH was modified to perform password hashing even when an account had no usable password hash, including accounts configured with * to block password logins.
The vulnerability has been fixed in OpenSSH 10.6p2, and Alpine Linux administrators are advised to update their OpenSSH packages using apk upgrade openssh.
Admins who can't immediately install the update can mitigate the issue by turning off SSH password authentication with PasswordAuthentication no in their SSH server configuration and restarting SSH.
Confirm whether OpenSSH is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
Kultekin says admins can also check for signs of exploitation by examining SSH authentication logs for password-based logins for accounts that should not allow them.
What happened
OpenSSH contains a critical flaw, prompting an urgent need for a fix.
Access requires local or already-authenticated credentials.
A newly disclosed vulnerability involving OpenSSH and musl, dubbed *sshole, allows attackers to log into specific Alpine Linux and other musl-based Linux accounts that block password authentication simply by entering an oversized password.
What changed
Security researcher Ozgun Kultekin, who discovered and released information on the vulnerability today, indicates that it has existed since 2016 and arises from OpenSSH's handling of password verification errors on systems utilizing the musl C library.
Kultekin warns that Alpine Linux's official AWS and Azure cloud images contain an affected default 'alpine' account with passwordless 'doas' privileges, potentially enabling attackers to gain root access.
The researcher identified the vulnerability using AI agents that conducted approximately 17,600 authentication tests with various OpenSSH configurations, malformed password hashes, and oversized passwords.
Who is affected
Anyone running OpenSSH is at risk, particularly where OpenSSH is actively deployed rather than merely licensed or installed in an unused capacity.
The flaw specifically impacts OpenSSH servers on Linux distributions that utilize the musl C library, such as Alpine Linux, OpenWrt, Buildroot, and Yocto, under certain authentication configurations.
Linux accounts can be set to block password logins by replacing their password hash with an asterisk (*) in the /etc/shadow file.
Why it matters
The advisory outlines the tangible security impact an attacker can achieve once they access the vulnerable path.
Since this is not a valid password hash, no password should permit access to those accounts.
This allows an attacker to submit an oversized password, prompting OpenSSH to compare the returned * with the account's stored *, leading to a successful login.
Technical details
This vulnerability is tracked as CVE-2016-6210 and is rated critical severity, which serves as the identifier for checking vendor guidance.
A patch introduced in OpenSSH in 2016 to address a username enumeration vulnerability tracked as CVE-2016-6210 altered how OpenSSH managed accounts without usable password hashes.
Systems employing glibc, such as Debian, Ubuntu, and Fedora, along with those utilizing PAM authentication, are not vulnerable to this attack.
Response
To prevent attackers from discerning valid usernames through varying response times, OpenSSH was adjusted to perform password hashing even when an account lacks a usable password hash, including accounts configured with * to block password logins.
The vulnerability has been resolved in OpenSSH 10.6p2, and Alpine Linux administrators are urged to update their OpenSSH packages using apk upgrade openssh.
Admins who cannot install the update immediately can mitigate the issue by disabling SSH password authentication with PasswordAuthentication no in their SSH server configuration and restarting SSH.
What security teams should do
Verify whether OpenSSH is present in your asset and software inventory.
Kultekin suggests that admins check SSH authentication logs for password-based logins for accounts that should not permit them to identify signs of exploitation.