On 5 November 2026 the OpenSSH project released OpenSSH 10.6p2 to "avoid password authentication bypass that is exploitable through sshd", and Alpine Linux published an advisory the same day. The flaw, nicknamed "*sshole" by the researcher who found it, lets anyone who can reach the SSH port log in to certain accounts without knowing the password. Alpine says it takes one connection and "works every time". No CVE had been assigned when Alpine published its advisory, and no source reports attacks so far.
How it works: without PAM, sshd checks passwords with the C library's crypt(). On musl libc, crypt() returns * when the password is longer than 256 bytes, and * is also what is stored for accounts that have no password (key-only users, for example). So a password of 257 to 1024 bytes matches. Alpine says the attack also needs at least one other local account with a $5$ or $6$ password hash, and PasswordAuthentication yes, which is the default. OpenSSH says it considers the root cause "outside sshd", but it can be avoided there.
Who is affected: Alpine's standard openssh-server package (built without PAM), or openssh-server-pam with UsePAM no, on Alpine 3.21 to 3.24 and edge, plus older releases back to 3.16. The researcher also names other musl systems such as OpenWrt, Buildroot and Yocto. Not affected: glibc-based Linux, PAM setups with UsePAM yes, locked accounts (!), Dropbear, OpenBSD, and containers that do not run an SSH server.
Cloud images: Alpine says its official tiny-cloud images from 3.18.11 through 3.24.3 ship an alpine user with a * password and passwordless doas, so once any $6$ hash exists on the machine, the bug can become a path to root.
Fixed versions on Alpine include 10.6_p2-r0 (edge), 10.3_p1-r2 (3.24), 10.2_p1-r1 (3.23), 10.0_p1-r11 (3.22) and 9.9_p2-r1 (3.21), also shipped in point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4. The bug was reported by Özgün Kültekin of Wakefield; the fix came from OpenSSH developers Damien Miller and Darren Tucker.
