What Is SSHole?
SSHole is a password check that goes wrong in OpenSSH's server, sshd, on Linux systems that use the musl C library and don't use PAM. Alpine Linux is the best-known example. For some accounts, including ones that aren't meant to have a password at all, any password between 256 and 1,024 characters is accepted. That lets an attacker log in over SSH, sometimes as root.
OpenSSH fixed it in Portable OpenSSH 10.6p2 on 5 November 2026. It is rated 8.1 out of 10. Within hours, The Hacker News reported attackers trying it, and CISA added it to its list of flaws being exploited on 9 November.
Am I Affected?
Only if all of these are true:
- The machine or container runs
sshdolder than 10.6p2. - It is built on musl libc, not glibc. Alpine is; Ubuntu, Debian, Red Hat, Rocky, Alma and Amazon Linux aren't.
sshddoesn't use PAM.- Password logins are allowed.
Check:
cat /etc/os-release # Alpine?
ldd --version 2>&1 | head -1 # says "musl" on musl systems
sshd -V # OpenSSH version
sudo sshd -T | grep -E 'passwordauthentication|usepam'Most servers on mainstream distributions are not affected. The ones to look at are Alpine servers, Alpine-based Docker containers that run sshd, and small appliances and routers built on musl.
How to Fix It
- Update OpenSSH: on Alpine,
apk update && apk upgrade openssh. Then restartsshd. - If you can't update straight away, turn off password logins. Set
PasswordAuthentication noandKbdInteractiveAuthentication noin/etc/ssh/sshd_config, and use SSH keys. Restartsshd. - Rebuild container images that include
sshdfrom an updated base image.
After Patching
If an affected machine was reachable on port 22, check /var/log/messages (or wherever your logs go) for successful password logins you don't recognise. Also look for new SSH keys in ~/.ssh/authorized_keys and new users. Anything odd means treating the machine as compromised.