Critical OpenSSH flaw exposes passwordless accounts
A vulnerability mainly affects specific Linux installations; OpenSSH has released a security update.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Hackers have exploited a critical flaw in OpenSSH that can, under certain conditions, allow them to log into accounts without a password. The vulnerability mainly affects systems using Linux distributions with musl, such as Alpine Linux, and an update is now available.
The flaw lies in sshd’s password-checking process, the server component of OpenSSH. According to security researchers, an attacker can under specific circumstances gain access to an account without a password if another account with a password hash is also present on the same machine.
The conditions limit the scope of the problem. According to security advisories, password login must be enabled and the installation must use OpenSSH without PAM, among other requirements. The flaw is therefore not automatically present on every Linux server running OpenSSH.
OpenSSH released version 10.6p2 to fix the problem. The release notes cite a bypass of password authentication as the reason for the security change. Alpine Linux has also published updated packages for affected versions.
Security researcher Özgün Kültekin reported, according to Help Net Security, that successful access was observed shortly after the disclosure on a honeypot running Alpine Linux and OpenSSH. Cloudflare reported the same vulnerability, but wrote that as of 6 November, OpenSSH and Alpine had not reported broader exploitation.
The name ‘SSHole’ refers to how the flaw arises, not to a separate product. Organisations should first establish whether their servers meet all the conditions, but systems that may be vulnerable should, according to security advisories, be updated as soon as possible or temporarily shielded from password login.
The vulnerability is mainly relevant to cloud servers, network equipment and small Linux installations based on musl. There is no indication that all passwordless accounts are thereby remotely accessible; the risk depends on the server’s configuration and the accounts present.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The technical conditions, patch and reports of possible exploitation can be traced to OpenSSH and independent security sources. The article makes clear that the flaw does not affect every OpenSSH installation.
- confirmed OpenSSH 10.6p2 fixes a bypass of password authentication. — Mentioned in OpenSSH’s release notes. source
- confirmed Under certain conditions, the flaw affects systems without PAM where password login is enabled. — The technical conditions are set out in the security advisory and Cloudflare’s analysis. source
- confirmed A researcher reported successful access on an Alpine honeypot. — Help Net Security quotes researcher Özgün Kültekin. source
Editor's note
The vulnerability and the patch have been confirmed. Exploitation was reported by a researcher on a honeypot; the scale of actual attacks has not been established.Sources
- OpenSSH Release Notes — OpenSSH
- OpenSSH flaw exploited in the wild just hours after disclosure — Help Net Security
- SSHole: OpenSSH password bypass on musl Linux — Cloudflare Radar
More on this in Dutch media
- AD — „openssh cybersecurity”
- RTL Nieuws — „openssh cybersecurity”
- FD — „openssh cybersecurity”