# OpenSSH flaw could expose locked accounts to unauthorised access on musl Linux

- URL: https://talkfuse.com/story/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/
- Published: 2026-11-05T18:29:00+00:00
- Updated: 2026-11-05T18:54:30+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910
- Topics: Software

## Key points

- A long password could bypass account restrictions in specific musl Linux setups.
- The flaw requires password authentication, no PAM and other precise conditions.
- OpenSSH 10.6p2 fixes the vulnerability.

## Summary

A flaw in certain OpenSSH configurations on musl-based Linux systems could let an attacker gain access to accounts that should not accept password logins, potentially including root. The vulnerability, called *sshole, matters because musl is widely used in embedded systems and is the standard C library for Alpine Linux, which supplies cloud images for AWS and Azure.

Exploitation requires several conditions: OpenSSH must run without PAM with password authentication enabled; an account must have a valid password hash; and the targeted account must have an asterisk in its password field. An attacker can then try a password of 257 to 1,024 characters. OpenSSH fixed the issue in version 10.6p2; systems that cannot be updated can disable password authentication.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.