MeridianMeridian

OpenSSH Releases Patch for Critical Authentication Bypass Affecting musl-Based Linux Distributions

OpenSSH has issued version 10.6p2 containing a mitigation for a critical vulnerability nicknamed '*sshole' that allows authentication bypass on systems using the musl C library. The flaw affects distributions including Alpine Linux, OpenWRT, Buildroot and Yocto where sshd runs without PAM and password authentication remains enabled. Attackers can log into accounts configured with a single asterisk as the password hash by supplying any password longer than 256 characters. Researcher Özgün Kültekin discovered the issue, which stems from legacy Unix password handling practices still present in modern images such as official AWS and Azure Alpine Linux builds. OpenSSH developer Damien Miller stated the root cause lies outside the project yet OpenSSH is well positioned to mitigate it, prompting an expedited release to prevent discovery by AI agents. Alpine Linux urges users running sshd to update immediately and restart the daemon, or disable password authentication if patching is not yet possible.

Security.NLTranslated from NL

Read at source

OpenSSH has released version 10.6p2 with a mitigation for a critical vulnerability that permits authentication bypass on certain Linux systems. The issue, dubbed *sshole, was discovered by researcher Özgün Kültekin and publicly disclosed by Damien Miller via Mastodon.

The vulnerability resides in systems that use the musl C library instead of glibc. Affected distributions include Alpine Linux, OpenWRT, Buildroot and Yocto. It does not affect OpenSSH directly on glibc-based systems but can be exploited when specific configuration conditions are met.

Successful exploitation requires the following conditions: the OpenSSH daemon (sshd) must be compiled against musl, PAM must be disabled, password authentication must remain enabled in sshd_config, an account must exist with only an asterisk (*) as its password hash (common for key-only users, LDAP users and the default root account on Alpine Linux), and another account with a real password must also be present.

Under these circumstances an attacker can authenticate to the asterisk-hashed accounts by supplying any password exceeding 256 characters. The asterisk hash originates from early Unix systems where it was placed in /etc/passwd to prevent login; modern systems still treat it as a non-matching hash during authentication.

OpenSSH states the root cause lies outside its codebase yet the project is positioned to mitigate the risk. Version 10.6p2 was released the day after disclosure because of concerns that AI agents could independently discover the flaw. Alpine Linux recommends that all users running sshd apply the update and restart the daemon; merely updating packages is insufficient because the running process must be replaced.

Administrators unable to patch immediately are advised to disable password authentication in sshd_config and restart the service. The distribution warns that an attacker with network access to the SSH port can log in without knowing any password in a single connection attempt.

OpenWrtOpenSSHYoctoAlpine LinuxmuslBuildrootOpenSSH 10.6p2
ShareXFacebookLinkedInReddit
Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Ubuntu Patches APT Vulnerability Allowing Root Access via Man-in-the-Middle Attacks
Vulns & Exploits

Ubuntu Patches APT Vulnerability Allowing Root Access via Man-in-the-Middle Attacks

Ubuntu has released updates addressing a flaw in the APT package manager that could let an attacker positioned for a man-in-the-middle attack gain root privileges on affected systems. The vulnerability, tracked as CVE-2026-109518, enables manipulation of HTTP traffic between a client and archive servers to deliver a malicious .deb package. Exploitation requires the client to retry a failed download, a behavior that is disabled by default starting with Ubuntu 22.04 LTS and later releases. Debian issued patches for the same issue earlier. While digital signatures are intended to prevent such attacks, the flaw allows APT to install the malicious package even when signature verification fails. Scripts inside installed .deb packages execute with root privileges, potentially leading to full system compromise.

Security.NLNov 5, 2026Translated from NL

OpenSSH Patches Critical Password Authentication Bypass Affecting musl libc Systems
Vulns & Exploits

OpenSSH Patches Critical Password Authentication Bypass Affecting musl libc Systems

OpenSSH version 10.6p2 introduces a mitigation for a critical vulnerability that allows password authentication bypass on Linux systems using musl libc with PAM disabled. The flaw affects configurations where password verification relies directly on the C library rather than PAM, enabling remote attackers to log in without valid credentials if PasswordAuthentication remains enabled. Systems running Alpine Linux containers or distributions such as postmarketOS, Void Linux musl variant, and certain OpenWRT setups with OpenSSH instead of Dropbear are most exposed. Damien Miller explicitly recommends setting PasswordAuthentication=no or disabling SSH entirely on affected hosts until patched. The issue was reported by Özgün Kültekin of Wakefield and stems from behavior outside sshd itself, though the daemon serves as the attack vector. Alpine Linux quickly issued updated packages, while OpenSSH developers cited rapid AI-driven rediscovery of bugs as justification for short disclosure timelines. No public exploit details or CVE identifier have been released yet.

ekurakNov 5, 2026Translated from Polish

ChatGPT Vulnerability Allowed JavaScript Execution and Full Account Takeover via Shared Conversation Links
Vulns & Exploits

ChatGPT Vulnerability Allowed JavaScript Execution and Full Account Takeover via Shared Conversation Links

Security researchers at Parameter discovered a critical flaw in ChatGPT that enabled remote code execution in a logged-in user's browser simply by clicking a shared conversation link. The attack chain combined the platform's HTML preview rendering feature with the MathLive library's unvalidated postMessage handling and a YouTube oembed callback to bypass CSP restrictions. Successful exploitation granted attackers access to private conversations, the ability to open chats, and full control over the victim's account. OpenAI acknowledged the issue as P1 severity, deployed a server-side fix within eight days, and paid a $5000 Bug Bounty reward. No user action was required as the patch was applied centrally. The vulnerability stemmed from the interaction of otherwise secure components rather than a single isolated flaw.

ekurakNov 5, 2026Translated from Polish