{"id":28,"date":"2026-11-11T09:41:05","date_gmt":"2026-11-11T14:41:05","guid":{"rendered":"https:\/\/highcomputing.link\/?p=28"},"modified":"2026-11-11T09:41:05","modified_gmt":"2026-11-11T14:41:05","slug":"the-dumbest-way-to-break-into-ssh-cve-2026-123158","status":"publish","type":"post","link":"https:\/\/highcomputing.link\/?p=28","title":{"rendered":"The Dumbest Way to Break Into SSH (CVE-2026-123158)"},"content":{"rendered":"\n

Every once in a while, a critical security vulnerability drops that makes you laugh before you check your fleet. It isn’t a complex cryptographic flaw or an esoteric memory corruption zero-day. It\u2019s an accidental comedy of errors where two completely reasonable safety features collided and accidentally left the front door wide open.<\/p>\n\n\n\n

Enter CVE-2026-123158<\/strong>, also known as “SSHHole.”<\/p>\n\n\n\n

The Two “Smart” Ideas<\/h3>\n\n\n\n

To understand how this broke, you only need to know how two separate systems tried to be safe:<\/p>\n\n\n\n

    \n
  1. The Classic Lockout Trick:<\/strong> For decades, Unix systems have disabled password logins on specific accounts by putting a single asterisk (*<\/code>) in their \/etc\/shadow<\/code> file. The idea is simple: no real password ever hashes down to just *<\/code>. If you can\u2019t generate that string, you can\u2019t log in with a password. It’s the standard way to enforce key-only access or lock a system account.<\/li>\n\n\n\n
  2. The Defensive Limit:<\/strong> Over in musl libc<\/code>\u2014the lightweight C library popular on minimal distributions like Alpine Linux\u2014developers wanted to protect against CPU-exhaustion attacks. They capped password length checks at 256 characters. If someone feeds in a password longer than that, it fails immediately. And rather than returning a null value that might crash lazy software, it returns a safe error code: *<\/code>.<\/li>\n<\/ol>\n\n\n\n

    The Facepalm Moment<\/h3>\n\n\n\n

    Picture what happens when someone attempts to log into a locked, key-only account using a random 257-character password:<\/p>\n\n\n\n

      \n
    1. OpenSSH hands the long password to the system to check.<\/li>\n\n\n\n
    2. The library sees 257 characters, rejects it for being too long, and returns its error string: *<\/code>.<\/li>\n\n\n\n
    3. OpenSSH takes that return value (*<\/code>), looks at the account’s stored password field (*<\/code>), and sees an exact match.<\/li>\n\n\n\n
    4. OpenSSH assumes the password is correct and drops the attacker straight into a shell.<\/li>\n<\/ol>\n\n\n\n

      *<\/code> equals *<\/code>. Access granted.<\/p>\n\n\n\n

      Who Actually Needs to Worry?<\/h3>\n\n\n\n

      If your servers run Debian, Ubuntu, Fedora, or RHEL, you’re fine. Those distros use glibc<\/code>, which doesn’t have this behavior.<\/p>\n\n\n\n

      This flaw lives almost exclusively in the Alpine Linux<\/strong> and embedded world. The crosshairs land on setups where:<\/p>\n\n\n\n

        \n
      • You’re running Alpine or another musl<\/code>-based distro.<\/li>\n\n\n\n
      • PasswordAuthentication yes<\/code> is enabled in sshd_config<\/code>.<\/li>\n\n\n\n
      • An account (like a default cloud user or service account) has its password disabled with *<\/code> under the assumption that keys are required.<\/li>\n<\/ul>\n\n\n\n

        On an Alpine cloud VM where the default user has passwordless administrative rights, feeding in 257 characters handed out instant root privileges without needing an SSH key at all.<\/p>\n\n\n\n

        What to Do<\/h3>\n\n\n\n
          \n
        • Update your packages:<\/strong> Upstream patched this immediately by making SSH reject stored hashes shorter than four characters. If you run Alpine boxes, update openssh<\/code> and bounce the daemon (package managers don’t restart running services for you).<\/li>\n\n\n\n
        • Hard-disable password auth:<\/strong> Never rely on an account simply “not having a password” as your only defense. Explicitly set PasswordAuthentication no<\/code> in your \/etc\/ssh\/sshd_config<\/code>.<\/li>\n<\/ul>\n\n\n\n

          Sometimes the scariest vulnerabilities aren’t high-level math\u2014they\u2019re just software accidentally agreeing with itself.<\/p>\n\n\n\n

          <\/p>\n","protected":false},"excerpt":{"rendered":"

          Every once in a while, a critical security vulnerability drops that makes you laugh before you check your fleet. It isn’t a complex cryptographic flaw or an esoteric memory corruption zero-day. It\u2019s an accidental comedy of errors where two completely reasonable safety features collided and accidentally left the front door wide open. Enter CVE-2026-123158, also […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_hide_featured_image":false,"_jetpack_featured_image_duplicate_dismissed":0,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-28","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/highcomputing.link\/index.php?rest_route=\/wp\/v2\/posts\/28","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/highcomputing.link\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/highcomputing.link\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/highcomputing.link\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/highcomputing.link\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=28"}],"version-history":[{"count":1,"href":"https:\/\/highcomputing.link\/index.php?rest_route=\/wp\/v2\/posts\/28\/revisions"}],"predecessor-version":[{"id":29,"href":"https:\/\/highcomputing.link\/index.php?rest_route=\/wp\/v2\/posts\/28\/revisions\/29"}],"wp:attachment":[{"href":"https:\/\/highcomputing.link\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/highcomputing.link\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/highcomputing.link\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}