Flawed OpenSSH lets attackers log into password-locked accounts with long passwords
An OpenSSH flaw called SSHole lets attackers log into password-locked accounts—those whose /etc/shadow field is literally an asterisk—by sending an oversized password, and can lead to root access where the account has passwordless administrative privileges, researcher Ozgun Kultekin said.
- Affected
- OpenBSD / OpenSSH before 10.6p2 (vendor CNA range: lessThan 10.6p2)
- Fixed
- OpenBSD / OpenSSH 10.6p2
GreyNoise recorded the first successful wild exploitation on November 7 at 00:46 UTC, logging 16 chains from six source IP addresses. Actors ran reconnaissance, queried cloud metadata services, tried to read password hashes and root SSH keys, and attempted to modify authorized_keys for persistence. One actor installed the TAC Agent implant, which never reached its command server.
musl returns an asterisk when password hashing fails on an oversized password, and OpenSSH mistakes it for a match to an account whose stored hash is literally *. OpenSSH before 10.6p2 on musl-based Linux without PAM, such as Alpine, is affected; 10.6p2 fixes it. Accounts with valid password hashes are not affected.
Administrators should update to OpenSSH 10.6p2 or disable SSH password authentication, then check asterisk-hash accounts for unexpected logins, unauthorized SSH keys, and TAC Agent files or startup services.
Sources & technical scope 2 sources
BleepingComputer — original source ↗
mitre CNA / CVE Program — original source ↗
Affected: OpenBSD / OpenSSH before 10.6p2 (vendor CNA range: lessThan 10.6p2)
Fixed: OpenBSD / OpenSSH 10.6p2
Exploitation: Known exploitation observed in the wild by GreyNoise on November 7, 2026; GreyNoise states its observed activity is not representative of broader exploitation.
Scope & limitations: Full victim scope and total exploitation volume are not established by supplied evidence; TAC Agent never contacted its C2 server, so operator origin is only suggested by Chinese-language implant comments, not confirmed.
External findings belong to the credited researchers.