Cybersecurity is frequently plagued by unexpected paradoxes, where security measures intended to harden a system end up creating pathways for critical vulnerabilities. This exact scenario has come to light with *sshole, a security flaw tracked as CVE-2026-123158, which remained hidden for roughly a decade within specific Linux configurations.
The Mechanics Behind the Bypass
The vulnerability primarily impacts Alpine Linux setups that pair OpenSSH with the musl system library while bypassing PAM (Pluggable Authentication Modules). Under standard operational parameters, when an account is explicitly restricted from accepting passwords—denoted by an asterisk (*) in system files—the server is expected to completely deny password-based login attempts.
However, security researcher Özgün Kültekin uncovered that when processing exceptionally long passwords ranging between 257 and 1.024 bytes, the musl library returns an asterisk to signal an error. OpenSSH mistakenly interprets this symbol as a match against the protected account, effectively granting unauthorized access.
Impact and Immediate Remediation
Although exploiting this flaw demands a very specific alignment of technical conditions—such as the coexistence of an active local account utilizing SHA-256 or SHA-512 password hashes and the absence of PAM—the potential risks are severe, particularly if administrative privileges are compromised. Cybersecurity firms have already observed automated exploitation probes targeting vulnerable setups.
In response, OpenSSH and Alpine Linux have released critical patches (including OpenSSH version 10.6p2). System administrators are strongly urged not only to apply these updates but also to restart the SSH service immediately, or temporarily disable password authentication entirely to secure their environments.