OpenSSH has released version 10.6p2 to address a significant security vulnerability that allowed unauthorized access to accounts without passwords. The issue, which stemmed from a complex interaction between OpenSSH and the musl C library, could enable attackers to bypass password authentication by submitting overly long passwords.
Technical notable move: How It Worked
The vulnerability, identified as CVE-2026-123158, allowed for authentication bypass on systems where accounts did not have a password set. This was achieved by sending a password string between 257 and 1024 bytes. Due to a series of historical design decisions in both musl and OpenSSH’s sshd, these excessively long passwords were incorrectly validated as a match against the empty password field, which is typically represented by an asterisk (*).
A Decade in the Making: Historical Context
This complex interplay of factors had remained undetected for approximately a decade. The underlying design choices contributing to the vulnerability date back to the 1980s, with specific modifications in musl occurring in 2012 and in sshd in 2016. The CVSS 3.1 score for the vulnerability is rated at 8.1, classifying it as high severity. CISA has assessed that proof-of-concept exploits are available, but the vulnerability is not currently believed to be actively exploited in the wild.
Systems particularly affected are those using the musl C library, such as Alpine Linux, when configured with specific OpenSSH settings. The vulnerability arises when OpenSSH is not using PAM, password login is enabled, the password field is represented by an asterisk, and a specific type of password hash (like SHA-512) is present. OpenSSH developers stated they became aware of the issue only a day before releasing the patch, describing the fix in 10.6p2 as a “stopgap fix.”
Özgün Kültekin of Wakefield security company is credited with discovering the vulnerability. The incident highlights how seemingly independent and reasonable design decisions made over many years in different software components can converge to create significant security risks. For instance, a change in musl in August 2012 modified its crypt() function to return an asterisk on failure, a behavior that, when combined with later changes in sshd designed to handle missing hash salts (related to CVE-2016-6210), created the conditions for this exploit.
Affected Systems and Mitigation
Alpine Linux has provided upgrade instructions and temporary mitigation steps for affected users. The recommended actions include updating OpenSSH packages and potentially adjusting sshd configurations. The vulnerability’s nickname, ‘*sshole’, reflects the critical role of the asterisk in the password field for accounts not intended for password login.
Developer Perspectives and Responsibility
While OpenSSH has released a patch, the differing perspectives on responsibility between OpenSSH and musl developers underscore the challenges in attributing blame for such emergent vulnerabilities. Musl author Rich Felker indicated that the issue lies with the caller’s misuse rather than musl itself, though changes are slated for the library. The National Vulnerability Database (NVD) lists the attack complexity as high, reflecting the specific conditions required for exploitation.
This event serves as a reminder that historical design choices, even those made with good intentions, can have unforeseen security consequences over time. System administrators are advised to apply the latest OpenSSH updates promptly and to remain vigilant regarding system configurations and potential interactions between different software components.
Why This Matters
The materials describe a narrow update: A vulnerability in OpenSSH, specifically in versions affecting systems using the musl C library, allowed attackers to bypass password authentication for accounts that did not have a password set. The exact year of the OpenSSH 10.6p2 release, though the CVE suggests 2026.
Broader Context
Source materials place the factual news in this context: The article references previous related news about vulnerabilities, including ‘PHP2Shell’, OpenAI’s ‘GPT-6 Cyber’ finding Firefox vulnerabilities, and a ‘Bitcoin core’ vulnerability.
Leave a Reply