Brief · Builders

sshhole: OpenSSH on Alpine Let Some Passwordless Accounts In. Update Today

By alkizz · Nov 5, 2026

First, the good news: a fresh Alpine image is not automatically open to root. According to the researcher, the dangerous path needs some other account on the box to have a real password set. Still, if you run sshd on Alpine or another musl Linux system, fix it today.

The fix is quick. Upgrade OpenSSH (upstream it's 10.6p2; on Alpine, apk upgrade openssh pulls your branch's fixed package), or set PasswordAuthentication no.

There's no CVE yet. I found no reported exploitation, and it's not in CISA's KEV catalog.

What went wrong

On Nov 5, OpenSSH shipped 10.6p2 with "a critical security workaround that affects Linux systems that use the musl libc and PAM disabled." It's a password authentication bypass. The researcher, Özgün Kültekin of Wakefield, calls it sshhole.

According to the researcher, musl's crypt() returns "" when it fails instead of an error, and some overlong passwords make it fail. For an account whose stored password field is just "", that failure looks like a match. The upstream fix is small: sshd now refuses to compare against any stored hash shorter than four characters.

OpenSSH says: "We consider the root cause of this bug to be outside sshd." Damien Miller of OpenSSH wrote that "we learned of the problem yesterday" and that they moved fast because of "rapid bug rediscovery by AI agents, sometimes within hours."

Who's actually exposed

Per the researcher, all of these have to be true:

• sshd running on musl Linux
• sshd built or run without PAM
• password authentication turned on
• an account whose password field is "*"
• some other account on the box with a real password

Alpine's official cloud image build script creates an alpine user with a "*" password and gives it passwordless root through doas. That's why the cloud angle matters. But again, per the researcher, that account only becomes reachable once some other account on the box has a real password. The risky case is Alpine cloud VMs where someone has set a password on any account.

Plenty of things aren't affected. Per OpenSSH, glibc Linux, non-Linux systems, and PAM password auth are fine. Alpine's Natanael Copa checked dropbear and says it isn't affected. The official alpine Docker image has no sshd at all, so it only matters where someone added openssh. OpenWrt uses dropbear by default, so stock installs aren't affected; ones switched to OpenSSH could be.

If you run agent sandboxes or dev containers on Alpine and added openssh with password logins, you meet the conditions too.

Fixed versions

Alpine openssh-server, per Alpine's package index:

• edge: 10.6_p2-r0
• 3.24: 10.3_p1-r2
• 3.23: 10.2_p1-r1
• 3.22: 10.0_p1-r11
• 3.21: 9.9_p2-r1

Alpine's Natanael Copa says all branches back to 3.16 are fixed. Upstream, the fix is OpenSSH 10.6p2.

What to do

• Upgrade OpenSSH now.

  • Why: the fix refuses the too-short "*" hash that made the bypass work. Upstream it's 10.6p2, and Alpine has fixed packages for its branches.
  • How: run apk upgrade openssh, restart sshd, and check your version against the list above.

• Can't upgrade yet? Set PasswordAuthentication no.

  • Why: the bypass only works through password auth.
  • How: set PasswordAuthentication no in your sshd config, then rc-service sshd restart. Make sure key login works before you restart so you don't lock yourself out.

• Find the sshd you forgot about.

  • Why: the stock alpine Docker image has no sshd, but images that added openssh, musl appliances, and builds without PAM can still be exposed.
  • How: list Alpine-based images and VMs that install openssh, and switch them to key-only auth.

Sources

• OpenSSH 10.6p2 release notes
• OpenSSH fix commit "avoid password authn bypass"
• Researcher's sshhole page
• Damien Miller (OpenSSH) on Mastodon
• Alpine Linux on Mastodon
• Natanael Copa (Alpine): all branches fixed
• Natanael Copa (Alpine): dropbear not affected
• Alpine aports 3.22 fix
• Alpine openssh-server packages
• Alpine cloud images setup script

← All briefs