OpenSSH flaw on musl-based Linux lets any 256+ character password unlock key-only accounts

Security researcher Daniel Lockyer has disclosed a critical OpenSSH vulnerability dubbed sshhole (details at sshhole.com): on Linux systems built on musl libc (Alpine, OpenWrt, Buildroot, Yocto, plus the many Docker images based on them, including the official AWS and Azure Alpine images), accounts whose passwords were set to "" since 2016 — i.e., key-only or LDAP-authenticated accounts that should reject password login, such as root or deployment accounts — can be successfully logged into with any password longer than 256 characters. Researchers including Geoffrey Huntley are urging all users to update immediately.

Confirmed

The flaw affects sshd running on musl-based systems without PAM, where password authentication is enabled
The root cause is that musl's crypt() no longer returns NULL on failure, causing anomalous handling of overlong passwords
Present since 2016, the issue covers Alpine, OpenWrt, Buildroot, Yocto and many common Docker images; default users of the official AWS and Azure Alpine images are also affected
sshhole.com has published a detailed post-mortem of the vulnerability

Why it matters

The musl ecosystem is widely used in containers and embedded devices; affected default images mean many production environments could be exposed to unauthorized logins
Accounts with "" passwords are typically considered safely locked (key-only/external auth), and admins rarely assume they can be logged into by password, so the risk is easily overlooked
Affected users should upgrade their systems and sshd as soon as possible and check whether PAM authentication is in use

2026-11-05 ~ 2026-11-05 · 7 related posts

Primary sources

OpenSSH on musl Linux accepted any password over 256 chars since 2016 — DanielLockyer · 2026-11-05 20:48 (UTC+08:00)
OpenSSH on musl Linux accepts any password over 256 chars — root risk on Alpine — DanielLockyer · 2026-11-05 20:51 (UTC+08:00)
The 9-year-old musl crypt() bug that let disabled openssh accounts take any long password — cramforce · 2026-11-05 22:02 (UTC+08:00)

New OpenSSH vuln on musl systems lets locked accounts log in with any long password — evilsocket · 2026-11-05
[source] OpenSSH on musl Linux accepted any password over 256 chars since 2016 — DanielLockyer · 2026-11-05
[source] The 9-year-old musl crypt() bug that let disabled openssh accounts take any long password — cramforce · 2026-11-05
Alpine SSH flaw: any password over 256 chars logs you in on AWS/Azure images — emax · 2026-11-05

3 near-duplicate retellings: DanielLockyer · TheZachMueller · Yamapama