OpenSSH has a vuln condition which allows logging in without a password. A thread.
https://www.openssh.org/releasenotes.html
It only impacts Linux distributions which ship with musl libc and PAM disabled. I think that is just Alpine Linux (all versions).
It doesn’t impact Debian, Ubuntu, SUSE, Redhat or CentOS. Nor OpenWrt.
This is the technical change to fix https://github.com/openssh/openssh-portable/commit/4353fdc43ef646c43a8dda7025cc1a898caf1482
This is the mitigation for Alpine Linux. It does fully break legit password authentication with SSH.
People are already spraying the Internet for this - they’re targeting root and alpine as usernames, and very long passwords (which bypasses auth).
First payload seen in honeypot is.. drumroll.. a coin miner.
Somebody probably needs to assign a CVE btw.
Brb off to brief the business about the new Asshole vuln
@GossiTheDog for a moment I was so scared
@GossiTheDog Got a CVE for that? I don't see it in the release notes
@nielsa there’s no CVE allocated as far as I know
@GossiTheDog Why is it breaking password authentication?
@BucciaBuccia because you turn password authentication off
Nov 5, 2026, 1:53 PM@GossiTheDog @BucciaBuccia Please, my friend, we want to buy a shelter for my family to protect us from the rain and cold. The price of a tent here is $700, so please give me money to buy this tent.https://chuffed.org/project/208485-give-waleeds-family-a-chance-to-live
@GossiTheDog I thought you mean password authentication wouldn’t work anymore if enabled
Nov 5, 2026, 12:38 PM@GossiTheDog
It' 2026... I really hope nobody exposes an SSH server with password auth enabled anymore on a network. 🙃
@GossiTheDog if I understand the fix correctly (and OpenSSH's description of the underlying vulnerability), it seems that what is being done is to enforce minimum length of a password (or the presence of an inputted password?) via an assertion on the length of the hashed value of the input.
What's wild about this is that the vulnerability depends on the libc implementation, suggesting that the correctness in the prior pw check implementation was to some degree incidental.
@GossiTheDog (also I wonder how using strcmp doesn't lead to a timing data leak in this case given what it's being used for)
@huronbikes @GossiTheDog These are hashes being compared, not raw passwords. The length is not sensitive information. I guess maybe you mean determining matching prefix length, but unless the hash algorithm is broken, knowing a prefix matched doesn't really get you very far.
Nov 5, 2026, 1:53 PM@GossiTheDog Please, my friend, we want to buy a shelter for my family to protect us from the rain and cold. The price of a tent here is $700, so please give me money to buy this tent.https://chuffed.org/project/208485-give-waleeds-family-a-chance-to-live
Nov 5, 2026, 2:14 PM@GossiTheDog Please, my friend, we want to buy a shelter for my family to protect us from the rain and cold. The price of a tent here is $700, so please give me money to buy this tent.https://chuffed.org/project/208485-give-waleeds-family-a-chance-to-live
@Suiseiseki no, it isn’t.
@GossiTheDog
Same as it ever was.
@GossiTheDog oh fuck, like the openwrt that is reskinned and installed on the vast majority of residential router/firewall hardware out of the box? 😬
*edit* no, because openwrt doesn’t actually use openssh
/me chuckles in opnsense
@WiteWulf @GossiTheDog OpenWRT usually uses dropbear, so which shouldn't have this vulnerability.
@jernej__s @WiteWulf @GossiTheDog aiui it’s not an openssh issue it’s musl, just openssh have patched to block it. dropbear may well also present the same vector.
@rfc6919 @WiteWulf @GossiTheDog It's an interaction between OpenSSH, musl and specific configuration (PAM being disabled).
@jernej__s @WiteWulf @GossiTheDog openssh says it’s not their bug they’re just blocking the vector. do we *know* that dropbear isn’t affected?
“We consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there.”
@WiteWulf first post notes it doesn’t apply to openwrt, just Alpine
@WiteWulf @GossiTheDog OpenWRT doesn't use OpenSSH, it's dropbear by default.
Thanking my lucky stars that none of mine are accessible from the "outside"...
Nov 5, 2026, 2:49 PM@GossiTheDog "oh did i say "i"? sorry. i had agent swarms. a lot of them. let's not get into it"
why not?
@f4grx @GossiTheDog
Maybe you're illustrating why not. Focus on the flaw he found more than the method he used to find it.
"But if he hadn't used AI to find it, it would be undiscovered and therefore secure by obscurity today!" Sure. Until someone who didn't have the discoverers disclosure integrity (public notice only after it had been patched) found it and used it to root every Alpine derivative container, server and device on the planet.
We can hate AI codeslop vibe coding all we like (and I DO), but the bad guys are gonna use agents to find vulnerabilities and break our stuff for nefarious purposes, if we don't do the same to proactively harden things, well that's just dumb in my $0.02.
To compile opensshd with every permutation of library and configuration and then automate throwing every permutation of dumb/stupid password at each one.. even IF you had the inclination to do so, that would take days/weeks to setup. The good guys simply don't have the resources.
Would I be incorrect coming away with the impression that the security industry is becoming exasperated, right at the moment?
Nov 5, 2026, 3:12 PM
Nov 5, 2026, 3:31 PM@GossiTheDog I hope it doesn’t spread too much..
@GossiTheDog oh jesus fuck does nobody test anything ever anymore?
@GossiTheDog can we please stop using C. As in, Computers.
Nov 5, 2026, 3:50 PM@jupiter @GossiTheDog C suite staff? yeah agreed, get rid.
@ret @GossiTheDog ah those too.
@gorplop @GossiTheDog the reason is asinine and dangerous return values.
@gorplop @jupiter @GossiTheDog the wild thing is, the change in musl *broke* backwards compatibility, and for a very questionable reason
@GossiTheDog wow :/
@GossiTheDog As a millionaire living my best life, I'm giving $20k to the first 5 people who message me"GRACE" | understand that many people are struggling with bills, and I want to help reduce that burden message me on telegram@manager4302
Nov 5, 2026, 9:48 PM@GossiTheDog Phuck.
@GossiTheDog what makes me really surprised with all the sshole fuss, is that there are people, who refusing to disable passowrd-based auth in 2026
@GossiTheDog There's CVE-2026-123158 now.
Previdian reports active exploitation attempts (but not a lot yet): https://previdian.com/CVE-2026-123158
Nov 5, 2026, 1:53 PM@GossiTheDog Please, my friend, we want to buy a shelter for my family to protect us from the rain and cold. The price of a tent here is $700, so please give me money to buy this tent.https://chuffed.org/project/208485-give-waleeds-family-a-chance-to-live
@GossiTheDog AIUI Void uses PAM by default, but is affected if you turned that off in sshd_config without also turning off PasswordAuthentication.
Regardless of what system you're on, with PasswordAuthentication=no (which everyone should be setting) you are not vulnerable.
@Suiseiseki @GossiTheDog My real question is, why the hell would musl decide to change how error handling works compared to glibc, in a way that resembles success?
@GossiTheDog For a moment I was like: "NOT AGAIN 😭"
@GossiTheDog anyone know if Docker containers running Alpine would have sshd running and enabled if ssh/sshd is not mentioned in the Dockerfile at all?