OpenSSH “sshole” Vulnerability Bypasses Disabled Password Authentication on Alpine Linux
What Happened — Researchers disclosed a flaw in OpenSSH when compiled against the musl C library (common in Alpine Linux and other musl‑based distributions). The bug, nicknamed “sshole,” allows an attacker to gain a shell by sending a password string longer than 256 bytes, even when the server is configured to block password authentication. The oversized payload triggers a logic error that skips the password‑disable check, resulting in a successful login with a valid user account. The issue has existed in the code for roughly a decade and was only recently discovered. No public exploit code has been released, but proof‑of‑concept demonstrations show the bypass works reliably on affected systems.
Why It Matters for Trust & Control Assurance — It highlights the need for rigorous verification that authentication controls (e.g., disabled password login) are truly enforced, a core access‑control assurance objective.
Who Is Affected — Cloud‑infrastructure operators, SaaS platforms, and any organization running Alpine Linux or other musl‑based containers that rely on OpenSSH for remote access.
Recommended Actions —
- Audit SSH configurations on all musl‑based hosts; ensure password authentication is disabled and that key‑based authentication is enforced.
- Apply any patches or updates released by the OpenSSH project promptly.
- Deploy log‑monitoring rules to detect unusually long password strings or unexpected successful logins.
- Conduct a penetration test focused on SSH authentication bypass scenarios.
Technical Notes — The vulnerability exploits an integer‑overflow handling path in the OpenSSH authentication module when compiled with musl. No CVE identifier has been assigned yet; the bug is classified as an authentication bypass (privilege escalation) with a high impact on confidentiality and integrity. Source: https://www.schneier.com/blog/archives/2026/11/new-openssh-vulnerability.html