OpenSSH Patches High-Risk sshhole Flaw Uncovered by AI Agents
AI assistants · AI coding · Enterprise AI
OpenSSH has issued updates to resolve the high-risk 'sshhole' vulnerability (CVE-2026-123158). Mainly affecting specific environments like Alpine Linux using the musl component, the flaw allows authentication bypass via passwords over 256 bytes due to asterisk return collisions. Security researchers uncovered the decade-old issue by deploying AI agents for massive abnormal login testing.
OpenSSH released a security update to address the high-risk vulnerability designated '*sshole' (CVE-2026-123158), rated 8.1 on the CVSS scale. The flaw primarily affects systems utilizing the musl libc component, such as Alpine Linux servers and containers, under specific conditions including enabled password logins and coexisting account types. When a password exceeding 256 bytes is entered, musl returns an asterisk indicating an error, which coincides with the asterisk marking password-disabled accounts, prompting OpenSSH to misjudge authentication. Mainstream Linux distributions, Windows, and Mac systems are unaffected. Researchers revealed the decade-old bug was detected after running roughly 17,600 abnormal login attempts per version using multiple AI agents. The OpenSSH team noted a recent influx of AI-assisted vulnerability disclosures and decided to temporarily accelerate software release intervals.
Key takeaways
- OpenSSH patched CVE-2026-123158 to prevent authentication bypass caused by musl returning an asterisk on passwords exceeding 256 bytes.
- The risk is largely limited to environments like Alpine Linux using musl without PAM; mainstream Linux distributions and typical desktop OS are unaffected.
- Security researchers deployed multiple AI agents running approximately 17,600 abnormal login attempts per version to uncover the decade-old flaw.
- Advisories urge administrators running affected Alpine Linux setups to update OpenSSH, restart services, disable password authentication, or refresh container images.
Source：數位時代 Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.