🔍 Read the full analysis: A Password-Length Flaw In OpenSSH Is Being Used Against Some Linux Servers on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A flaw tracked as CVE-2026-123158 can let attackers log in to certain accounts on Linux servers using OpenSSH with a very long password. The issue affects a narrow set of systems using musl without PAM and with password authentication enabled; OpenSSH released version 10.6p2 on November 5, and exploitation was reported soon after. Administrators should update, restart sshd and review authentication logs.
Attackers are exploiting a password-length flaw in OpenSSH to access certain accounts on Linux servers, according to GreyNoise and reporting by BleepingComputer. The vulnerability, CVE-2026-123158, affects a limited configuration—OpenSSH running on Linux with the musl C library, without PAM, and with password logins enabled—and was patched in OpenSSH 10.6p2.
OpenSSH released version 10.6p2 on November 5. GreyNoise and BleepingComputer reported that public exploit code appeared about four hours later, and GreyNoise observed a successful break-in on one of its sensors roughly 40 hours after the release. CISA added the vulnerability to its list of exploited vulnerabilities on November 9. Those reports indicate active exploitation, but do not establish how many servers or organizations have been affected.
The flaw arises when sshd checks passwords without PAM on a system using musl. Alpine Linux says musl’s crypt() function returns an asterisk as an error indicator when the supplied password exceeds 256 bytes. On affected systems, that can match the asterisk stored for an account with no password, allowing authentication to succeed. The source says the attacker sends a password between 257 and 1,024 bytes; the account must also meet other conditions, including the presence of a local account with a qualifying password hash.
Alpine Linux’s standard openssh-server package is a prominent affected case. The issue is not described as affecting every Alpine installation: password authentication must be enabled, PAM must not be used for the check, and an account with the relevant locked-password field must be present. Ubuntu says its OpenSSH is linked against glibc and uses PAM, and is not vulnerable. Red Hat also says its products are not affected; Debian’s tracker rates the issue unimportant for its packages.
OpenSSH password flaw is under active attack
A narrow set of Linux server configurations can accept an overlong password for certain accounts. Administrators should check their setup, patch, restart sshd and review authentication logs.
Who may be exposed
Exposure depends on several settings and account conditions being present together.
musl without PAM
OpenSSH must check passwords without PAM, with password authentication enabled.
Specific account fields
An account with an asterisk password field and a qualifying local password hash must be present.
Some Alpine systems
Alpine’s standard openssh-server package is a known case, but not every installation is affected.
How the check can fail
The submitted password can trigger an error value that matches an account’s stored field.
The reported password length is between 257 and 1,024 bytes.
For passwords exceeding 256 bytes, musl’s crypt() returns an asterisk as an error indicator.
On affected systems, that error value can match the asterisk stored for an account with no password.
What distribution statements say
| Distribution or package | Reported status |
|---|---|
| Alpine standard openssh-server | Known affected case when conditions match |
| Ubuntu | Not vulnerable; uses glibc and PAM |
| Red Hat products | Not affected, according to Red Hat |
| Debian packages | Rated unimportant by Debian’s tracker |
Administrator response
Verify each system’s libraries, sshd settings and account conditions.
- Install OpenSSH 10.6p2 or the applicable fixed distribution package.
- Restart sshd so the patched daemon is running.
- If patching is delayed, set PasswordAuthentication no.
- Review authentication logs for unexpected password logins to accounts without passwords.
Why Exposed SSH Servers Need Attention
SSH is a common way for administrators to access and manage servers remotely. On a system meeting the vulnerability’s conditions, an attacker able to reach the SSH service could bypass the expected password check for certain accounts. The risk is especially consequential if an accessible account can gain elevated privileges through another mechanism.
The reported exploitation makes this more than a theoretical coding issue for administrators of affected systems. At the same time, the conditions sharply limit the known exposure: systems using glibc, PAM-based password checks, or disabled password authentication are outside the affected configuration described in the source. Administrators should identify the actual libraries and sshd settings in use rather than assume that every Linux server is vulnerable—or that a distribution’s name alone settles the question.
Products Worth Considering
Apple Watch SE 3 GPS 40mm Smartwatch
DJI Mini 4 Pro Fly More Combo Drone with DJI RC 2
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Bluetooth 5.3, USB-C Charging, IPX4, Black
As an affiliate, we earn on qualifying purchases.
How the Password Check Failed
Linux account records commonly use an asterisk in the password field to indicate that password login is unavailable. In the affected OpenSSH configuration, sshd asks the system’s crypt() function to process the submitted password and compares the result with the stored field. Alpine’s advisory says musl returns the same asterisk when the password is too long, making an error value appear to match the account’s stored value.
Responsibility for the underlying issue has been disputed. OpenSSH said the root cause is outside sshd, though the problem can be exploited through sshd and avoided there. Musl maintainer Rich Felker said he considers the issue an erroneous use by the caller, while adding that musl may change the mechanism in a future release cycle. The OpenSSH fix is available as version 10.6p2.
The source also identifies Alpine’s official tiny-cloud images from versions 3.18.11 through 3.24.3 as a special concern: they include an account with an asterisk password field and passwordless doas. Alpine says those images become exploitable once a qualifying password hash exists on the machine. It lists fixed packages across supported and older Alpine branches, but administrators must restart sshd after upgrading because replacing the package alone does not replace the running daemon.
“musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password.”
— Alpine Linux advisory
How Broad Is Exploitation?
The available reporting does not say how many servers have been compromised, identify affected victims, or establish whether all reported attacks used the same method. GreyNoise’s observation was on one sensor; it is evidence of exploitation, not a count of incidents across the internet. The source also notes that the embedded Linux ecosystem is less clear: Medcrypt reported reproducing the issue on a stock Yocto image, while the full range of affected device builds is not established.
Administrators still need to check each system against the required conditions. A musl-based distribution alone does not confirm exposure: PAM use, password-authentication settings, account fields and the presence of a qualifying hash all matter. The source does not provide a complete inventory of vulnerable deployments or a confirmed timeline for any musl change.
Patch, Restart and Review Logs
Administrators of potentially affected systems should install OpenSSH 10.6p2 or a distribution-provided fixed package and restart sshd so the patched daemon is running. If an update cannot be applied promptly, the source recommends setting PasswordAuthentication no. Teams should also check authentication logs for password logins to accounts that have no password and investigate any unexpected access.
Further clarification may come from distribution advisories, device vendors and musl’s future release work. Until then, operators of embedded or custom Linux builds should verify their own library and sshd configuration rather than rely on statements about major distributions that use different components.
Key Questions
Which systems are affected by CVE-2026-123158?
The described exposure requires Linux with musl, OpenSSH checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and at least one local account with a qualifying hash. Alpine’s standard openssh-server package is a known example, but not every installation necessarily meets all conditions.
Are Ubuntu, Debian and Red Hat systems affected?
Ubuntu says its OpenSSH uses glibc and PAM and is not vulnerable; Red Hat says its products are not affected. Debian’s security tracker rates the issue unimportant for its packages. These statements concern those distributions’ packages, not every custom-built system that might use different components.
What should administrators do?
Install OpenSSH 10.6p2 or the applicable fixed distribution package, then restart sshd. If patching is delayed, disable password authentication with PasswordAuthentication no and review logs for suspicious password logins to accounts without passwords.
Has the flaw been exploited in real attacks?
GreyNoise reported a successful break-in on one of its sensors about 40 hours after the OpenSSH fix was released, and CISA added the flaw to its exploited-vulnerabilities list on November 9. The source does not give a total number of victims or affected servers.
Source: ThorstenMeyerAI.com
