A severe flaw in OpenSSH that has existed since 2016, dubbed "sshole," allows unauthenticated attackers to obtain root access on Linux systems through specially crafted long passwords. The vulnerability affects systems running the musl libc library with SSH configured without PAM authentication modules and password authentication enabled.
Exploitation requires two specific conditions: the target account must have an asterisk in its password field, and at least one other account on the system must have a valid password hash. When these conditions are met, passwords between 257 and 1,024 characters can bypass authentication restrictions and grant access to accounts that should reject password authentication entirely—including the root user and accounts configured to accept only SSH keys.
The vulnerability has been patched in OpenSSH version 10.6p2 and later. Security researcher Özgün Kültekin has released commands to check for potential account compromise, available on TabNews. If you operate affected systems, upgrade immediately and run the provided diagnostics to verify no unauthorized access has occurred.