# SZB-f2f032fedb: OpenSSH flaw reportedly allows login to password-disabled musl-based Linux accounts

A newly disclosed OpenSSH vulnerability, dubbed "*sshole", reportedly lets attackers log in to some Alpine Linux and other musl-based accounts that block password authentication by submitting an oversized password.

- Type: Early warning
- Kind: Vulnerability
- Vendor: OpenSSH
- Product: sshd
- Status: Reported, not confirmed
- Sources: 5 distinct
- First seen: 2026-11-05 09:32 UTC

> No statement or filing from OpenSSH has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

A newly disclosed OpenSSH vulnerability, dubbed "*sshole", reportedly lets attackers log in to some Alpine Linux and other musl-based accounts that block password authentication by submitting an oversized password. The report comes from BleepingComputer, which describes the flaw as newly disclosed.

## What to do

- Check whether any servers run OpenSSH on Alpine Linux or other musl-based distributions.
- Apply the OpenSSH or distribution patch as soon as it is available.
- Restrict SSH access to trusted networks until patched.
- Review authentication logs for unexpected logins.

## Timeline

- 2026-11-05 09:31 UTC: Made public by Mastodon
- 2026-11-05 09:32 UTC: First seen by cve.now
- 2026-11-06 02:30 UTC: Record last updated

## Evidence (5 sources)

- 2026-11-05 · Social · [Mastodon](https://infosec.exchange/@harrysintonen/117563134390229975): “\* sshd(8): avoid password authentication bypass that is exploitable through sshd(8) that affects some Linux systems when built and run with PAM support disabled.”
- 2026-11-05 · Social · [Mastodon](https://infosec.exchange/@DailyCyberSecurity/117564312171957924): “Update Alpine Linux OpenSSH servers to OpenSSH 10.6p2 now to fix a critical password authentication bypass affecting passwordless accounts.”
- 2026-11-05 · Social · [Mastodon](https://infosec.exchange/@thecybersecguru/117564934907175617): “A newly disclosed vulnerability in OpenSSH allows unauthenticated remote attackers to gain access to certain musl-based Linux systems using a specially crafted password of 257 bytes or more.” (+1 more: [Mastodon](https://mastox.eu/@thecybersecguru/117567110082406486))
- 2026-11-05 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/): “A newly disclosed OpenSSH vulnerability dubbed "\*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password.” (+1 more: [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzlgci3o3525))
- 2026-11-05 · Social · [oss-security](https://seclists.org/oss-sec/2026/q4/522): “"sshole": password authentication bypass: OpenSSH + musl libc” (+5 more: [oss-security](https://seclists.org/oss-sec/2026/q4/533), [oss-security](https://seclists.org/oss-sec/2026/q4/534), [oss-security](https://seclists.org/oss-sec/2026/q4/535), [oss-security](https://seclists.org/oss-sec/2026/q4/536), [oss-security](https://seclists.org/oss-sec/2026/q4/537))

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-f2f032fedb&body=https%3A%2F%2Fcve.now%2FSZB-f2f032fedb%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-f2f032fedb

### Has OpenSSH confirmed it?

Mastodon, Mastodon and Mastodon report it. No statement from OpenSSH has reached cve.now yet.

Source: https://infosec.exchange/@harrysintonen/117563134390229975, https://infosec.exchange/@DailyCyberSecurity/117564312171957924, https://infosec.exchange/@thecybersecguru/117564934907175617, https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/, https://seclists.org/oss-sec/2026/q4/522

### What should OpenSSH users do?

Check whether any servers run OpenSSH on Alpine Linux or other musl-based distributions. Apply the OpenSSH or distribution patch as soon as it is available. Restrict SSH access to trusted networks until patched. Review authentication logs for unexpected logins.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-f2f032fedb
Site guide for agents: https://cve.now/llms.txt