🔍 Read the full analysis: Could An Overlong Password Put Some Linux Servers At Risk? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
A flaw tracked as CVE-2026-123158 can let an attacker log in to some Linux accounts without a valid password by sending an overlong password. The risk is limited to specific musl-based systems running OpenSSH without PAM and with password authentication enabled; administrators should install the fix and restart sshd, or disable password authentication.
A flaw in OpenSSH can let attackers log in to certain Linux accounts without knowing a valid password, by submitting an unusually long password. The vulnerability, CVE-2026-123158, affects a narrow combination of settings involving the musl C library, password authentication and OpenSSH running without PAM; OpenSSH released a fix, version 10.6p2, on November 5.
The failure occurs when OpenSSH checks a password without PAM. On affected systems, the musl library’s crypt() function returns an asterisk as an error indicator when the submitted password exceeds 256 bytes. An asterisk can also be the stored password field for an account that is not meant to accept password logins. In the affected configuration, those matching values can cause sshd to accept the login instead of rejecting it.
According to the Alpine Linux advisory, the attacker must be able to reach the server’s SSH service, and the system must meet several conditions at once: Linux with musl, password checking without PAM, password authentication enabled, an account whose password field is *, and at least one local account with a $5$ or $6$ password hash. Alpine says a single account with a password hash can be enough to meet the final condition.
Exploit code was publicly available about four hours after the fix, according to GreyNoise and BleepingComputer. GreyNoise reported its first successful login on a sensor roughly 40 hours after the release. The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its exploited-vulnerabilities list on November 9. Those reports indicate exploitation has occurred, but the supplied material does not establish how many servers or organizations were affected.
Could an overlong password put Linux servers at risk? A narrow OpenSSH flaw
CVE-2026-123158 can bypass password checks on systems with a specific combination of musl, OpenSSH and account settings. Exposed administrators should patch, restart sshd and review authentication logs.
When the bypass can work
The required conditions must coincide; OpenSSH alone does not make a server vulnerable.
Linux uses musl, and OpenSSH checks passwords without PAM.
Password authentication is enabled, and an account has an asterisk in its password field.
At least one local account has a $5$ or $6$ password hash.
How the match causes a login
An overlong password makes musl return an asterisk as an error indicator. In this configuration, that can match an account’s asterisk password field and lead sshd to accept the login.
- Password authentication is disabled
- Debian, Ubuntu and Red Hat builds are reported unaffected
- Alpine and other musl-based systems
- Customized and embedded builds, including reported Yocto reproductions
What is known about exploitation
Exploit code appeared after the fix, and successful logins were observed. The supplied material does not establish how many systems or organizations were affected.
Reduce exposure
Act on the package and configuration that actually run on the server.
- Install the applicable fixed package; the upstream fix is OpenSSH 10.6p2.
- Restart sshd after upgrading so the fixed daemon is running.
- If an update cannot be applied promptly, set PasswordAuthentication no.
- Review authentication logs for password logins to accounts with an asterisk password field.
- Verify the library, PAM use, authentication setting and account records; do not rely on a distribution name alone.
Risk for Exposed musl Servers
The flaw matters most to administrators of Alpine Linux and other systems built around musl, especially servers reachable from untrusted networks. If all required conditions are present, the problem can turn a password field intended to block logins into a path for unauthorized access. A successful login could be particularly serious where that account can use other tools or permissions to gain elevated access.
The practical exposure is narrower than the broad use of OpenSSH might suggest. The supplied advisories say OpenSSH builds from Debian, Ubuntu and Red Hat are not affected, citing differences such as glibc linkage or PAM use. Systems with password authentication disabled are also outside the stated conditions. Administrators still need to verify their actual build and configuration rather than assume that a distribution name alone settles the question.
Public exploit code and observed successful logins make prompt remediation relevant for exposed systems. Updating the package is not enough by itself if the old daemon remains active: Alpine specifically instructs administrators to restart sshd after upgrading.
Products Worth Considering
Amazon Kindle Scribe (3rd Generation), 64GB, 11-inch Display, Graphite, with Premium Pen
Apple MacBook Air 13.6-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, Midnight
DJI Mini 4K Drone with 4K UHD Camera
As an affiliate, we earn on qualifying purchases.
How the Asterisk Match Occurs
In many Linux account records, an asterisk in the password field signifies that the account cannot authenticate with a password. The vulnerability arises from the interaction between that convention, OpenSSH’s password-checking path when PAM is not used, and musl’s response to an overlong input. The issue is tracked as CVE-2026-123158 and has a reported severity rating of 8.1, classified as high.
Responsibility for the underlying behavior is disputed. OpenSSH said the root cause is outside sshd, though it can be exploited through sshd and avoided there. Musl maintainer Rich Felker said he viewed the issue as an erroneous use by the caller rather than a musl bug, while indicating the library’s behavior may change in a future release cycle. Alpine’s advisory describes how the interaction produces the bypass.
Alpine’s official tiny-cloud images from versions 3.18.11 through 3.24.3 are called out in the advisory because they include an alpine account with an asterisk password field and passwordless doas. Alpine says those images are safe on first boot but become exploitable once a qualifying $6$ hash exists on the machine. The advisory also warns that OpenSSH’s default root-login restriction does not prevent escalation through a separate account that can become root.
““musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long.””
— Alpine Linux advisory
Which Deployments Remain Exposed
The full number of vulnerable systems and confirmed intrusions is not established in the supplied material. Exposure depends on several configuration details, so a Linux host running OpenSSH is not, by itself, evidence that the server is vulnerable. Administrators need to check the C library, PAM use, password-authentication setting and account records.
The scope of risk in embedded Linux systems also remains less settled. The source material says Medcrypt reported reproducing the issue on a stock Yocto image, while the researcher also identified OpenWrt, Buildroot and Yocto as possible affected environments. That report does not establish that every system using those projects is vulnerable. The precise scope across vendor products and customized builds is unclear.
The underlying library behavior and attribution are disputed between OpenSSH and the musl maintainer. The available information also does not provide a count of affected Alpine cloud images or details about the systems behind the observed successful logins.
Patch, Restart and Review Logs
Administrators should install a fixed OpenSSH package and restart sshd so the updated daemon is running. OpenSSH’s upstream fix is version 10.6p2. Alpine says it published corrected packages for its branches, including versions back to 3.16; package versions vary by branch, so administrators should follow the applicable Alpine advisory and repository instructions.
Where an update cannot be applied promptly, the supplied guidance is to set PasswordAuthentication no. Administrators should also inspect authentication logs for password logins to accounts whose password field is an asterisk. A suspicious record warrants investigation, but the source material does not prescribe a single incident-response procedure for every deployment.
Further clarity depends on distribution and vendor advisories, especially for embedded and customized systems, as well as any changes to musl’s handling of overlong inputs. Until then, operators should verify their own package and configuration rather than infer safety from a platform label alone.
Key Questions
Can any Linux server running OpenSSH be attacked this way?
No. The reported bypass requires a specific combination: Linux with musl, OpenSSH checking passwords without PAM, password authentication enabled, an account with an asterisk password field, and a local account with a qualifying $5$ or $6$ hash. The advisories say Debian, Ubuntu and Red Hat builds are not affected.
What should an administrator do first?
Install the fixed package that applies to the system and restart sshd. If an update cannot be applied, disable password logins by setting PasswordAuthentication no, then review logs for password logins to accounts with an asterisk in the password field.
Does disabling root password login prevent the flaw?
Not necessarily. Alpine warns that a separate account may still be able to log in and become root through a privilege tool such as doas. Administrators should check all affected accounts and privilege paths, not only the root-login setting.
Are OpenWrt, Buildroot and Yocto systems affected?
They may be, depending on their libraries, OpenSSH build and configuration. The source material reports a reproduction on a stock Yocto image, but it does not establish that every system using these projects is vulnerable. Operators should check vendor guidance and verify the conditions on each system.
Source: ThorstenMeyerAI.com
