{"rewrite":{"id":"r_acf08d272f910ee035f2f19c","clusterId":"c_78ca6a491bd9a16d24146e3f","slug":"openssh-flaw-sshole-lets-long-passwords-bypass-disabled-logins","model":"deepseek-v4-1-flash","headline":"OpenSSH Flaw *sshole Lets Long Passwords Bypass Disabled Logins","summary":"A vulnerability called *sshole (CVE-2026-123158) in OpenSSH lets an attacker log in without the correct password on some systems. Researcher Ozgur Kurtekin of Wakefield published the details on November 5, 2026. The flaw needs musl libc, no PAM, password authentication enabled, and another local account with a SHA-256 or SHA-512 hash. A password of 257 bytes or more then matches the disabled account's stored asterisk.","whyItMatters":"The bug sits in the gap between OpenSSH and musl libc, where a failed hash computation returns the same asterisk used to mark password login as disabled, so accounts meant to be unreachable can be opened with one long password and one connection.","webCardHtml":"\u003cp\u003eThe attack needs a specific stack. Alpine Linux and similar systems use musl libc, whose crypt() function returns \u0026#34;*\u0026#34; when hashing fails, and SHA-256 or SHA-512 hashing fails on passwords longer than 256 bytes. OpenSSH compares that result to the stored hash under some conditions, so a 257 byte password against an account marked \u0026#34;*\u0026#34; matches.\u003c/p\u003e\u003cp\u003eAlpine\u0026#39;s advisory lists the remaining conditions: password authentication enabled, PAM not in use, and a second local account with a valid SHA-256 or SHA-512 hash. The attack takes a single connection, with no repeated password attempts, and a password between 257 and 1024 bytes.\u003c/p\u003e","blueskyPost":"OpenSSH's *sshole needs four conditions at once: musl libc, no PAM, password auth on, and a local account with a SHA-256 or SHA-512 hash. That stack of requirements limits exposure far more than the 257-byte password.","twitterPost":"OpenSSH's *sshole needs musl libc, no PAM, password auth on, and a local account with a SHA-256 or SHA-512 hash. Four conditions at once narrow the risk.","threadsPost":"OpenSSH's *sshole is real, but it needs musl libc, no PAM, password authentication enabled, and another local account with a SHA-256 or SHA-512 hash. All four in place before a 257-byte password can match the disabled account. The conditions, not the password length, decide who is exposed.","newsletterBlurb":"A vulnerability named *sshole in OpenSSH can let an attacker into accounts with password login disabled. The flaw appears on musl libc systems such as Alpine Linux when PAM is not used, and a password of 257 bytes or more makes a failed hash match the stored asterisk. Researcher Ozgur Kurtekin published the details on November 5, 2026.","attributionJson":"[{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20261106-openssh-xsshole/\",\"title\":\"OpenSSH vulnerability \\\"*sshole\\\" went unnoticed for about 10 years, allows bypassing accounts with password login disabled using passwords of 257+ characters\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":5580,"outputTokens":813,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1793934293,"createdAt":"2026-11-06T02:59:13.000Z","publishedAt":"2026-11-06T03:03:51.000Z","updatedAt":"2026-11-06T03:03:51.000Z"},"cluster":{"id":"c_78ca6a491bd9a16d24146e3f","canonicalTitle":"約10年間見逃されていたOpenSSHの脆弱性「*sshole」が発覚、257文字以上のパスワードでログイン禁止アカウントを突破可能に","representativeArticleId":"a_d9d3816be88f71d578440f96","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[\"OpenSSH\"],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-11-06T02:25:00.000Z","lastSeenAt":"2026-11-06T02:25:00.000Z","updatedAt":"2026-11-06T03:03:51.000Z"},"attribution":[{"source":"GIGAZINE","url":"https://gigazine.net/news/20261106-openssh-xsshole/","title":"約10年間見逃されていたOpenSSHの脆弱性「*sshole」が発覚、257文字以上のパスワードでログイン禁止アカウントを突破可能に"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":["OpenSSH"],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":["The vulnerability is tracked as CVE-2026-123158 and nicknamed *sshole.","Ozgur Kurtekin of Wakefield published the details on November 5, 2026.","The flaw affects OpenSSH on systems using musl libc, such as Alpine Linux, without PAM.","A password of 257 bytes or more can match the asterisk stored for accounts with password login disabled.","The attack succeeds in one connection and needs another local account with a SHA-256 or SHA-512 hash."],"pageLinks":{"healthSlugs":["openssh"],"storySlugs":[],"entities":[{"slug":"openssh","supported":0,"disputed":0,"contradicted":0,"unverified":0,"overall":"unverified","story_count":1,"has_dossier":false}],"stories":[],"entitiesOk":true,"storiesOk":true}}