New OpenSSH vuln on musl systems lets locked accounts log in with any long password
evilsocket · x · 2026-11-05
A disclosed vulnerability dubbed sshole affects OpenSSH on musl-based systems (Alpine, OpenWrt, buildroot, yocto, many Docker images) since 2016: accounts that should never accept a password (root, key-only deploy users, LDAP users, etc.) can log in with any password longer than 256 characters.
The author traces the history from Bill Joy's lock in 1980 /etc/passwd, through sshd's crypt() password check, to musl's 2012 change where crypt() returns a single character instead of NULL on failure — which programs blindly compare against the stored field.
Urgent advice: if you run sshd with password auth on a musl box, update immediately or disable password auth.
- Affected: Alpine, OpenWrt, buildroot, yocto, common Docker images
- Root cause: musl crypt() failure behavior breaks the "no password can match" assumption
- Action: update now; official writeup linked
More from Safety
- Dev builds a working keylogger in 15 minutes, then can't reliably detect it — MariyaSha888 · 2026-11-05
- GraySwan CEO: fake multi-turn chats manipulate agents; red teaming skill is composing attacks — TechNadu · 2026-11-05
- Sanders' Ban Artificial Superintelligence Act looms over January agenda as opponents mobilize — Inviolate_Violet · 2026-11-05
- Moonshot AI sought Nvidia Blackwell rentals in Europe, 8,000-GPU clusters, per CNBC — rohanpaul_ai · 2026-11-05
- Confessions of OnlyFake's founder: AI-powered fake IDs at $15 each made over $1M — 404 Media · 2026-11-05
- AI Industry Repackages $10 Trillion Infrastructure Buildout to Appease a Hostile Electorate — RebeccaBellan · 2026-11-05