The OpenSSH sshole Vulnerability: Two Different Kinds of 'No Match' Accidentally Matched

The OpenSSH sshole vulnerability, CVE-2026-123158, let a remote attacker log into an account with no password set on Alpine Linux, using nothing but an unusually long password string. According to The Hacker News , threat intelligence firm Previdian observed the first exploitation attempt less than nine hours after the CVE was published, and confirmed successful root access on a honeypot running real Alpine Linux and OpenSSH.

Jump to why this took forty years to notice for the part of this story that's genuinely remarkable.

What the Bug Actually Does

The mechanism, as documented in detail by ox.security's technical analysis , comes down to two unrelated systems independently choosing the same sentinel character to mean "this will never match," then being compared against each other. An account with no password set stores a single asterisk, * , in its password field.…