OpenSSH 10.6p2 Patches Decade-Old 'SSHole' Flaw in Alpine Linux

Key points

• The vulnerability, discovered by Özgün Kültekin of Wakefield, affects systems using musl libc without PAM and with password authentication enabled.
• Attackers can gain access to accounts marked with an asterisk (*) in the password field by submitting a password between 257 and 1,024 bytes long.
• The flaw stems from a 2016 OpenSSH change to prevent user enumeration, which interacts poorly with musl’s handling of long passwords in SHA-512 hashing.
• OpenSSH released version 10.6p2 on November 5, 2026, and Alpine Linux issued fixed packages for all branches from 3.16 to 3.24.
• No active exploitation has been reported, but administrators should check logs for unauthorized password logins and disable password authentication if patching is not immediately possible.

Background

This vulnerability is part of a broader trend of AI-assisted discovery of long-standing software flaws. Our archive notes that OpenAI’s AI pipeline recently identified 948 Linux root exploits in 30 hours, highlighting how AI accelerates both discovery and remediation. The 'SSHole' flaw, present since 2016, was found through brute-force testing of various libc and PAM configurations, a method that AI agents are increasingly capable of automating.

How outlets are covering it

The Register emphasizes the niche but critical nature of the vulnerability, noting its impact on embedded systems and Alpine Linux cloud images. Ars Technica highlights the ease of exploitation and the widespread use of Alpine in containers and embedded devices, with over 1 billion Docker Hub downloads. OX Security provides technical details on the interaction between OpenSSH and musl, noting the lack of a CVE designation at the time of reporting. The Hacker News focuses on the immediate fix and the importance of disabling password authentication as a temporary measure. All sources agree on the urgency of patching but differ in their emphasis on the technical root cause and the broader implications for AI-assisted vulnerability discovery.

Why it matters

The 'SSHole' vulnerability exposes a critical gap in authentication systems used in cloud and embedded environments. With Alpine Linux widely used in containers and cloud images, the potential for widespread exploitation is significant. The flaw’s presence for a decade underscores the need for rigorous testing of edge cases in security-critical software. As AI agents become more capable of finding such flaws, the window for exploitation may shrink, making rapid patching and proactive security measures essential.

What to watch

Administrators should immediately update OpenSSH to version 10.6p2 or later and Alpine Linux to the latest patched versions. Those unable to patch should disable password authentication and restart the SSH daemon. Monitoring logs for unauthorized password logins and reviewing system configurations for exposed accounts is recommended. The OpenSSH team has indicated that long embargoes are dangerous, suggesting a shift toward faster disclosure and patching in the future.