OpenSSH flaw lets attackers log into password-disabled Linux accounts

November 5, 2026 · 5:45 pm 3 sources

Image: BleepingComputer

Coverage

Coverage

• OpenSSH flaw lets attackers log into password-disabled Linux accounts
  BleepingComputer · November 5, 2026 17:45
  A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. [...]
• Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
  Ars Technica · November 5, 2026 23:09
  Certain configurations of Alpine are affected. Other distros may be as well.

More coverage

• OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
  The Hacker News · November 5, 2026 16:42
  Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw…