Security researchers have uncovered a decade-old password-authentication bypass vulnerability in OpenSSH that affects some Linux systems.
Exploiting the vulnerability is relatively easy, too, prompting OpenSSH to rate the flaw as critical and release version 10.6p2 to address the issue, which could allow an attacker with network access, an account name, and nothing more than a password between 257 and 1,024 characters long.
Any password.
The bug was reported by Özgün Kültekin of agentic security firm Wakefield, who dubbed the flaw ‘*SSHole’.
“Some accounts have no password by design. Their password field holds a single *, which no password can match. Root on Alpine, users who sign in with SSH keys only, and LDAP users are examples. These accounts should never accept a password,” Kültekin said in a blog post.
“On affected servers, they accepted any password between 257 and 1,024 characters long.
“The OpenSSH release notes describe 10.6p2 as ‘a critical security workaround that affects Linux systems that use the musl libc and PAM disabled.’ The OpenSSH team considers the root cause to be outside OpenSSH, and fixed it in OpenSSH because it can be exploited there.”
Kültekin has also created a website dedicated to how they found the flaw and its history at https://sshhole.com/.
Damien Miller, a two-decade Google veteran and one of OpenSSH’s maintainers, urged anyone operating a Linux system that uses musl libc without PAM, such as Alpine Linux, to “stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.”
“We are making this release as fast as possible (we learned of the problem yesterday) because we have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers,” Miller said in a post to LinkedIn.
watchTowr’s head of threat intelligence, Jake Knott, told Cyber Daily that it’s not every day that a vulnerability in something as prevalent as OpenSSH can be summed up as “just ‘send a long password’ or ‘send a lot of A characters’.”
“SSH is on just about everything and is often public-facing for server management, but the prerequisites mean many systems won’t be affected. Exploitation requires a specific combination: musl, no PAM, password login enabled and, critically, a locked account with a username the attacker knows,” Knott said.
“On Alpine’s AWS and Azure images, that’s reportedly the default ‘alpine’ user, which is likely what we’ll see targeted first. Internet-exposed SSH servers are already being hammered by password guesses and brute-force attempts around the clock – exploiting this vulnerability simply means those same attackers add a very long password attempt to that brute-force list.
“We'd be extremely surprised if we didn't see SSH brute-forcers attempting this by the weekend. It's virtually free to try and an easy win if it works. If your organisation is affected, update to the latest version where possible, and disable password-based authentication as a temporary mitigation if you can't.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
