SSHole: an OpenSSH flaw lets attackers log into servers without a password, and attackers are already trying to exploit it

The flaw mainly affects servers based on Alpine Linux and similar systems, which are very common in containers and network gear. The fix is already available, and the time to update is now

Techwire staff · Edited by: Eyal Abuksis-Levi · November 10, 2026 · 3 min read

The developers of OpenSSH, the software used to connect remotely to most of the world's servers, released an urgent security update for a flaw nicknamed SSHole. Under certain conditions, it allows logging into a server without knowing the password. It was rated high severity, and the fix is included in version 10.6p2. According to reports in the security press, attackers are already trying to exploit it.

The problem is not exactly in OpenSSH but in its interaction with musl, a basic library some Linux distributions use instead of the more common glibc. When OpenSSH checks passwords itself, without the PAM authentication mechanism, an especially long password makes the hashing function fail and return a value identical to the one marking a locked account. The result: the server accepts the attacker instead of rejecting them. Several conditions must hold for the attack to succeed, including password login being enabled.

Who is at risk? Mainly systems based on Alpine Linux, a lightweight distribution that is very popular as a base for cloud containers, as well as systems such as OpenWrt, used in routers and network equipment, and custom builds for embedded devices. Major distributions such as Debian, Ubuntu and Fedora, which use glibc, are generally not affected. Red Hat said its products are not affected.

What to do? Update OpenSSH to version 10.6p2 or your distribution's patched package and restart the SSH service. Anyone who cannot update immediately can disable password login and switch to SSH keys, a step recommended anyway. And check containers too: an old Alpine image running in production with SSH open is exactly the target this flaw is waiting for.

And the broader lesson: in the container world, many organizations do not know exactly which versions of which libraries they are running. A flaw that depends on a combination of a specific library and a specific setting is a reminder that an up-to-date software bill of materials (SBOM) is not bureaucracy but the only way to quickly answer the question 'are we exposed?'

Keep reading

Cyber & Security

A critical Xen Orchestra flaw is being exploited: attackers are taking over virtualization servers

An authentication bypass in the tool for managing XCP-ng servers lets an attacker gain admin rights without a password. For organizations that moved from VMware to cheaper alternatives, it is a reminder the alternative needs protection too

Techwire staff / 3 min read

Cyber & Security

A forgotten cloud vendor became a back door: an attacker abused Qubole's access to customers' AWS accounts

Researchers at Wiz and Israeli company Sentra exposed an attack in which an attacker used a data platform's permissions to get into dozens of companies' cloud environments and steal secrets and data. Many customers had probably forgotten that access existed

Techwire staff / 3 min read

Cyber & Security

Explainer: What is a 'cross-account role' in the cloud, and why it has become attackers' favorite door

Almost every organization in the cloud gives outside vendors access to its account, usually through a mechanism called a cross-account role. The Qubole attack shows what happens when the vendor is breached, or when everyone forgets the access is still there

Techwire staff / 3 min read