OpenSSH "*sshole" Flaw Lets Attackers Bypass Password-Disabled Logins on musl-based Linux

What Happened

A newly disclosed OpenSSH vulnerability, nicknamed "*sshole," reportedly lets attackers log in to certain musl-based Linux accounts, including on Alpine Linux, even when those accounts are configured to block password authentication. According to the report, the attacker simply enters an oversized password during login. The exact root cause, the affected version range, and any CVE identifier have not been confirmed. Treat these details as preliminary pending an official advisory.

Why It Matters for Defenders

Alpine Linux is widely used as a minimal base image for containers because of its small musl-libc footprint. If the report holds, this issue could reach many container and cloud-native environments, not just traditional server fleets. Accounts that administrators believe are password-login-disabled may not actually be protected. This undermines a common SSH hardening step.

What Defenders Should Watch For Now

• Inventory which hosts and container images are musl-based (Alpine and similar) and have SSH exposed, even internally.
• Review sshd_config and PAM settings on those hosts. Do not assume "PasswordAuthentication no" or locked passwords are sufficient on musl systems until vendor guidance is available.
• Hunt for anomalous SSH authentication attempts involving unusually long password strings or malformed credential payloads in auth logs.
• Flag successful logins to accounts that are supposed to be password-disabled, such as service accounts and root, for manual review.
• Prioritize patching once Alpine, OpenSSH, or musl maintainers publish fixed packages. In the meantime, consider key-only authentication plus network-level restrictions such as allowlists and bastion hosts.

Developing Situation

This is a fresh report. Key technical details, including affected version ranges, a CVE identifier, and an official fix, have not yet been established. Treat this as early-stage intel and watch for follow-up advisories from OpenSSH, musl, and Alpine. Original report: BleepingComputer.