A decade-old vulnerability named *sshole allows attackers to SSH into Linux devices without a password under specific configurations. Affected systems include Alpine Linux using OpenSSH with musl and no PAM, requiring passwordless accounts with SHA256/SHA512 hashes.
Background
Alpine Linux is a lightweight distribution using musl libc instead of glibc, often chosen for containers and embedded systems. The vulnerability highlights risks when OpenSSH interacts with musl without PAM authentication.
- Source
- Ars Technica
- Published
- Nov 6, 2026 at 07:09 AM
- Score
- 8.0 / 10