🔍 Read the full analysis: Attackers Are Using An OpenSSH Bug That Affects Some Linux Servers on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Attackers have exploited an OpenSSH password-checking flaw on certain Linux servers using musl, without PAM and with password authentication enabled. OpenSSH released version 10.6p2 on Nov. 5; administrators should update and restart sshd or disable password authentication while patching. Most systems using glibc or PAM are not affected, according to their maintainers and distributors.
Attackers have used a flaw in OpenSSH to log in without a valid password on some Linux servers, according to security reports cited by ThorstenMeyerAI.com. The vulnerability, tracked as CVE-2026-123158 and rated High at 8.1, affects systems running OpenSSH on the musl C library without PAM when password logins are enabled; OpenSSH released a fix on Nov. 5.
The bug can allow a remote attacker who can reach an SSH service to access certain accounts by submitting an unusually long password. The affected configuration must meet several conditions, including an account whose password field contains an asterisk and at least one local account with a $5$ or $6$ password hash. The report says the attacker’s password can be between 257 and 1,024 bytes long.
According to the source report, exploit code appeared publicly about four hours after the patch release, citing GreyNoise and BleepingComputer. GreyNoise recorded its first successful break-in on one of its sensors about 40 hours after the release. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its catalog of exploited vulnerabilities on Nov. 9.
The recommended response is to install a fixed OpenSSH package and restart sshd, since updating the files alone does not replace an already running daemon. Administrators who cannot patch immediately should set PasswordAuthentication no and review authentication logs, particularly for password logins to accounts that should not accept passwords.
OpenSSH flaw puts some Linux servers at risk Check your configuration and patch
Attackers have exploited a password-checking flaw in a narrow set of Linux setups. Administrators should install the fix, restart sshd, and check authentication logs.
Who may be exposed
Every condition must apply; Linux alone does not mean a server is vulnerable.
Why the check can fail
In the affected setup, an unusually long password can make musl return an asterisk error indicator that may appear to match an account’s stored field.
The attacker must be able to reach the server’s SSH service.
The reported password length is 257 to 1,024 bytes.
Under the affected conditions, the flawed comparison can allow access without a valid password.
Systems to check
Builds and settings vary, so verify the actual system rather than relying on its Linux distribution name.
- Alpine, OpenWrt, Buildroot and Yocto environments
- Alpine tiny-cloud images if a qualifying password hash was added
- Embedded and custom builds with musl
- Ubuntu says its build uses glibc and PAM
- Red Hat says its products are not affected
- Also listed: PAM-based checks, disabled password authentication, Dropbear, non-Linux systems, and containers without sshd
Respond and verify
Updating files alone does not replace an already running sshd process.
Risk Concentrated in Specific Linux Builds
The flaw matters because it can turn an exposed SSH service into an entry point without requiring an attacker to guess or obtain a legitimate password. SSH is commonly used to administer servers remotely, so access to an affected account could give an intruder a foothold on a machine and, depending on that account’s permissions, a route to further access.
The exposure is not universal across Linux. The source report identifies Alpine Linux’s standard openssh-server package as a prominent affected case, while Ubuntu says its OpenSSH build uses glibc and PAM and is not vulnerable. Red Hat also says its products are not affected. Administrators need to check the actual system configuration rather than assume all Linux servers are at risk—or that a server is safe merely because it runs Linux.
Some Alpine cloud images warrant particular attention. Alpine says specified tiny-cloud images include an account with an asterisk password field and passwordless doas; those images become exploitable if a qualifying password hash is added. A compromised account that can elevate privileges can make the issue more serious than a limited user login.
Products Worth Considering
Dell UltraSharp U2724DE 27-Inch WQHD IPS Black Monitor
Apple Mac mini (M6, 12-core CPU and GPU, 24GB RAM, 1TB SSD)
Canon IVY 2 Mini Photo Printer Bundle, Blush Pink
As an affiliate, we earn on qualifying purchases.
How the Password Check Fails
In the affected setup, OpenSSH checks passwords without PAM and calls the system’s crypt() function to compare a submitted password with the stored account field. Alpine’s advisory says musl returns an asterisk as an error indicator when the password exceeds 256 bytes. Some accounts that are not meant to accept password logins also have an asterisk in the password field. The failed password check can therefore appear to match that field.
OpenSSH says the root cause lies outside sshd, although the issue can be exploited through sshd and avoided there. Musl maintainer Rich Felker disputed that the behavior is a musl bug, describing it as an erroneous use by the caller, and said musl may change the mechanism in a future release cycle. This disagreement does not change the immediate patch recommendation for affected systems.
The affected conditions are narrow: Linux with musl; OpenSSH checking passwords without PAM; password authentication enabled; an account with an asterisk password field; and at least one local account with a qualifying $5$ or $6$ hash. The source lists Alpine, OpenWrt, Buildroot and Yocto as environments to check. Non-Linux systems, glibc-based Linux systems, PAM-based password checks, systems with password authentication disabled, and systems using Dropbear are listed as unaffected. Containers that do not run sshd inside are also outside the described exposure.
“An attacker who can reach your SSH port can log in without knowing any password.”
— Alpine Linux advisory
Which Embedded Systems Are Exposed
The precise number of vulnerable servers and successful intrusions is not established in the source material. GreyNoise’s reported observation came from one sensor; it does not provide a count of victims across the internet. The report also does not identify the affected organizations or say whether any observed access led to data theft, persistence or further compromise.
Exposure in embedded and custom Linux products may be harder to determine because vendors can build OpenSSH with different libraries and settings. Medcrypt said it independently reproduced the issue, including on a stock Yocto image, but that finding does not establish how widely vulnerable Yocto-based products are deployed. Administrators and vendors need to verify each build against the stated conditions.
The upstream OpenSSH and musl maintainers also differ on whether the underlying fault belongs to sshd or its use of musl’s password-checking behavior. The practical fix is available, but the source does not give a final resolution to that technical disagreement.
Patch, Restart and Check Logs
Administrators should install OpenSSH 10.6p2 or a vendor package containing the fix, then restart sshd and verify that the running service uses the updated version. Alpine says it published fixed packages for branches from edge back to 3.16; package versions differ by branch, so operators should follow the advisory for their release.
If an immediate update is not possible, disable password authentication with PasswordAuthentication no and confirm that the setting is active. Review SSH authentication logs for unexpected password logins to accounts that normally have no password, and investigate any unfamiliar access. This is a mitigation, not a substitute for applying the fix.
Operators of OpenWrt, Buildroot, Yocto and other musl-based systems should check whether their builds meet all the affected conditions. Vendors may issue further package guidance, and the source report says musl may change its behavior in a coming release cycle. The available information does not establish a broader impact count, so system-by-system verification remains necessary.
Key Questions
Which Linux servers are vulnerable to CVE-2026-123158?
Only systems meeting all the reported conditions are affected: Linux with musl, OpenSSH checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and at least one local account with a $5$ or $6$ hash.
Are Ubuntu, Debian and Red Hat systems affected?
Ubuntu says its OpenSSH build uses glibc and PAM and is not vulnerable; Red Hat says its products are not affected. Debian’s tracker rates the issue unimportant for its packages and lists the fixed upstream version in its unstable branch. Administrators should still follow their distribution’s security notices.
What should administrators do first?
Install a fixed OpenSSH package and restart sshd. If patching must wait, disable password authentication and check logs for unexpected access. Updating the package without restarting may leave the old daemon running.
Does the flaw affect every account without a password?
No. The reported bypass depends on the full set of system conditions, including an account represented by an asterisk password field and a qualifying password hash on the machine. Locked accounts with an exclamation mark in the password field are listed as unable to log in through this issue.
How widespread are the successful attacks?
The source reports a successful break-in observed on one GreyNoise sensor about 40 hours after the patch release, but gives no overall victim count. The scale of exploitation and any resulting damage remain unclear.
Source: ThorstenMeyerAI.com
