OpenSSH has rolled out Portable OpenSSH 10.6p2 to mitigate a significant authentication vulnerability affecting Linux systems employing musl libc without PAM This article explores pam_unix authentication backdoors. . The flaw, identified on November 5, 2026, allows attackers to bypass account restrictions by submitting passwords between 257 and 1,024 bytes.
Researcher Özgün Kültekin of Wakefield discovered the issue, christened sshole, while testing authentication behaviors across various OpenSSH versions.
Unlike malicious pam_unix.so authentication backdoors, this bypass requires no replacement binaries or prior compromise: incompatible error handling converts a failed hashing operation into an apparently successful credential comparison. A salt-selection mechanism, introduced to mitigate the CVE-2016-6210 username-enumeration timing leak, provides another account's hashing parameters when the target lacks usable parameters. Exploitation requires several conditions: sshd must use musl, authenticate without PAM, permit password logins, and expose an account whose password field is exactly "*".
Alpine’s official AWS and Azure images are noteworthy because the default alpine account can perform root-level operations through passwordless doas, enabling unauthorized access post takeover. Unlike ProxyCommand shell injection, which targets client-side command processing, sshole attacks server-side password verification. The patch requires stored hashes to contain at least four characters before accepting a comparison and copies password fields to avoid static-buffer aliasing.
Explore for your team.
