Tech

Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 06/11/2026, 00:13:23 UTC.

Briefings

A decade-old vulnerability in Alpine Linux allows attackers to bypass password authentication and log into devices without credentials. The exploit requires OpenSSH to use the musl library instead of libc and disables PAM authentication modules. Successful exploitation depends on the existence of a password-hashed SHA256 or SHA512 account and a configured passwordless account (marked with '*').

Key points

• Alpine Linux distributions are affected by a vulnerability allowing passwordless SSH access via OpenSSH and musl library interaction.
• Successful exploitation requires specific system configurations: a password-hashed SHA256/SHA512 account and a passwordless account marked with '*' in /etc/shadow.

Context

Alpine Linux is a lightweight, widely used distribution where OpenSSH and musl interact to bypass standard authentication. This finding is critical for security teams managing systems with passwordless accounts, such as those using certificate-based authentication.

Limitations

Evidence covers only Alpine Linux and potentially other distributions using the same OpenSSH/musl configuration. Specific system details, exact dates of vulnerability discovery, and precise impact metrics on other platforms remain unverified.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 06/11/2026, 00:50:41 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeibpkk4sz3uh4fw4qshbkgizwrmawoxm3c7ojgvw7srqpqslqaycm4