sshhole: OpenSSH Authentication Bypass on musl libc Systems Without PAM
OpenSSH 10.6p2 was released on 5 November 2026 as an emergency update to close a remarkable authentication bypass flaw. On Linux systems using musl libc without PAM, an attacker could log into an account whose password was deliberately disabled in /etc/shadow simply by presenting any string longer than 256 bytes.
Chain of decisions that created the flaw
The vulnerability emerged from a sequence of individually reasonable engineering choices. In traditional Unix, a password field containing only '*' disables password authentication while still permitting key-based login. In 2012, musl developers changed crypt() to return '*' instead of NULL on errors to prevent crashes in applications that failed to check the return value. The same year they added a 256-byte limit to SHA-512 crypt to mitigate denial-of-service attacks.
In 2016, OpenSSH addressed timing side-channel attacks (CVE-2016-6210) by selecting a salt from another account that possessed a real hash. When that salt used the $6$ SHA-512 format, the combination produced an unexpected result: a long password triggered musl's length limit, which returned '*', and OpenSSH's comparison then treated the error indicator as a successful match.
Exploitation requirements and impact
Successful exploitation required musl, OpenSSH without PAM, enabled password authentication, an account marked with '*' in shadow, and at least one other account with a compatible real hash. The issue affected Alpine Linux installations; some official cloud images granted the 'alpine' user passwordless doas privileges, turning an SSH login into immediate root access.
Systems using Dropbear instead of OpenSSH, including many OpenWrt deployments, were not affected. The proper account-locking mechanism via the sp_expire field in shadow remains unaffected and should not be confused with the '*' password marker.
Discovery and recommended mitigation
Researcher Özgün Kültekin from Wakefield identified the flaw after running approximately 17,600 non-standard authentication test cases through multiple OpenSSH builds with the assistance of LLM agents. Until systems are updated to OpenSSH 10.6p2 or the corresponding distribution patch, administrators are advised to set PasswordAuthentication no wherever password-based login is not required.
Related articles
Critical Command Injection Vulnerability in SolarWinds Dameware Enables Remote System Compromise
SolarWinds disclosed CVE-2026-28336, a critical command injection flaw in its Dameware remote support tool on November 3, 2026. Rated 9.9 out of 10, the vulnerability allows an authenticated user to execute arbitrary commands on remote systems managed by the software. The issue stems from insufficient input validation when user-supplied data is passed to the operating system, enabling attackers to append malicious commands. Exploitation requires only a valid, even low-privileged, Dameware account and occurs over the network with low complexity and no user interaction. The flaw affects version 2026.3 and all prior releases, with a fix available in 2026.3.1. SolarWinds also recommends reviewing account lists and restricting network access to administrative segments. This marks the latest in a series of security issues for the vendor, following a privilege escalation fix in 2025 and patches for fifteen Serv-U vulnerabilities in July.
GhostMap Vulnerability Forces Android Devices into Unrecoverable Boot Loops
Bitdefender researchers have identified GhostMap, a vulnerability that causes system_server to crash repeatedly when processing a specially crafted APK file. The flaw stems from inconsistent handling of ZIP archive parameters across Android system libraries, allowing a malformed resource to trigger an infinite reboot cycle. No code execution or permissions are required; the malicious APK only needs to be present on the device. The issue affects devices running Android 10 and later, with successful reproduction demonstrated on a Pixel device running Android 17 and the August 2026 security patch. Safe mode fails to interrupt the loop, and recovery often requires a factory reset that erases local data. Google initially closed the report as unreproducible before reassigning it to the appropriate team for potential future remediation.
CISA Adds Apple CVE-2024-27834 to Known Exploited Vulnerabilities Catalog After Confirmed Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency has added the Apple vulnerability CVE-2024-27834 to its Known Exploited Vulnerabilities catalog following confirmed in-the-wild exploitation. The flaw impacts multiple Apple platforms including iOS, iPadOS, macOS, Safari, tvOS, and watchOS. It is an authentication bypass issue that can be exploited for arbitrary read and write operations when an attacker already possesses initial access rights. The vulnerability was discovered and patched in 2024, yet exploitation activity has now prompted federal action. NIST rates the issue at CVSS 5.5 Medium. U.S. federal agencies are required to apply mitigations by November 18.
Ruby on Rails Releases Security Updates Fixing 21 Vulnerabilities Including Critical Active Storage Flaw
The Ruby on Rails development team has issued security updates for versions 8.1.4.1 and 8.0.5.2 that address a total of 21 vulnerabilities. One issue rated critical affects the Active Storage component when ImageMagick is used for image processing. The flaw tracked as CVE-2026-122006 carries a CVSS v3.1 base score of 9.8 and could allow arbitrary file writes or data exfiltration from untrusted uploads. Additional high-severity problems enable remote code execution, arbitrary file reads, parameter validation bypass, IP spoofing, cross-site scripting, and denial-of-service conditions. The 8.0 branch will reach end of security support on November 7, 2026, after which no further fixes will be provided. Administrators are strongly advised to apply the patches immediately.