OpenSSH password login can be bypassed on Alpine and other musl Linux servers (SSHOLE)

6 November 2026High

OpenSSH · OpenSSH sshd on musl libc Linux (Alpine, OpenWrt, Buildroot, Yocto) · SSHOLE

OpenSSH password login can be bypassed on Alpine and other musl Linux servers

A flaw nicknamed *sshole lets someone log in over SSH to an account that has no password, such as a key-only account, by sending an overlong password. The OpenSSH project calls its fix a critical security workaround, and says the root cause lies outside sshd, in how musl libc handles long passwords. No CVE has been assigned yet, and no attacks have been reported.

Affected: OpenSSH sshd on Linux systems that use musl libc (Alpine, and per the researcher OpenWrt, Buildroot, Yocto and many Docker images) with PAM disabled and password logins on, which is the OpenSSH default. Accounts with a `*` password field are at risk, including key-only users and root on Alpine. glibc systems, PAM setups, Dropbear and OpenBSD are not affected.
What to do: Upgrade to OpenSSH 10.6p2 or later (on Alpine, apk upgrade openssh), then restart sshd. If you cannot upgrade yet, set PasswordAuthentication no (check your key login works first) and restart sshd. Check logs for unexpected password logins on key-only accounts.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.
Why it’s here: The OpenSSH project rates the fix critical; remote login bypass on a common container and hosting base image; widely covered.

OpenSSH password login can be bypassed on Alpine and other musl Linux servers

Affected

OpenSSH sshd on Linux systems that use musl libc (Alpine, and per the researcher OpenWrt, Buildroot, Yocto and many Docker images) with PAM disabled and password logins on, which is the OpenSSH default. Accounts with a `*` password field are at risk, including key-only users and root on Alpine. glibc systems, PAM setups, Dropbear and OpenBSD are not affected.

What to do

Upgrade to OpenSSH 10.6p2 or later (on Alpine, apk upgrade openssh), then restart sshd. If you cannot upgrade yet, set PasswordAuthentication no (check your key login works first) and restart sshd. Check logs for unexpected password logins on key-only accounts.General information summarised from the vendor's advisory at the time of writing, not professional advice. Check the vendor's current advisory before acting.

Why it’s here

The OpenSSH project rates the fix critical; remote login bypass on a common container and hosting base image; widely covered.