#Buildroot
LightNews LightNews
gracekind.net
so openssh on mus! linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016. accounts that should never take a password at all (root, your key-only deploy user, Idap users, the default user on alpine's aws and azure images) take any password longer than 256 characters. yes, any password. yes. i know. yes.
November 5, 2026 at 1:39 PM
dlmetcalf.bsky.social
So many embedded systems based on Buildroot, Yocto etc. too.

Remote management in some industrial control systems, healthcare devices, maybe some vehicles, etc.
November 6, 2026 at 12:31 AM
anildash.com
Chat is it good if any long password works on root? sshhole.com (absolutely incredible name for this vulnerability, too.)
*sshole so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016. accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters.
November 5, 2026 at 3:15 PM
felicitas.pojtinger.com
I think I really need a build server, I feel like I've bootstrapped a clean Buildroot like 5-6 times in the last week
November 7, 2026 at 12:35 AM
patigallardo.bsky.social
Well. Shit. 💩
sshhole.com
*sshole so openssh on musi linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016. accounts that should never take a password at all (root, your key-only deploy user, Idap users, the default user on alpine's aws and azure images) take any password longer than 256 characters. yes, any password. yes. i know. yes.
November 5, 2026 at 5:53 PM
algocompsynth.bsky.social
This is obscure as all get out, but by a strange twist of fate I've been working with Alpine Linux for a couple of months. And I'm planning to do some Yocto or Buildroot hacking soon. So ... passing this on.

sshhole.com
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 6, 2026 at 7:31 AM
oh.heyw.tf
Pra todo mundo de tech: se voce tem qualquer coisa rodando sshd em musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled), ta na hora de fazer um update CORRENDO

"yes, any password. yes. i know. yes."

sshhole.com
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 5, 2026 at 4:21 PM
mihaizaurus.at
Another day, another vulnerability learned.

Seems to affect some #linux distros using musl (alpine, openwrt, buildroot, yocto) and potentially some docker images using them.

sshhole.com
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 5, 2026 at 3:39 PM
dotbatman.com
SSH Hole CVE-2026-123158

nvd.nist.gov/vuln/detail/...

sshhole.com
«openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016.”
NVD - Home
nvd.nist.gov
November 6, 2026 at 5:53 AM
pojntfx.mastodon.social.ap.brid.gy
I think I really need a build server, I feel like I've bootstrapped a clean Buildroot like 5-6 times in the last week
November 7, 2026 at 12:31 AM
diodesign.org
Apparently discovered by agents: sshhole.com

Affects alpine, buildroot, and others inc via SSH

"Accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters."
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 5, 2026 at 5:28 PM
tierrasapiens.bsky.social
🖲️ #Noticia #CiberSeguridad #Cybersecurity #CiberNoticia

SSHole: falla de OpenSSH en sistemas con musl (Alpine, OpenWrt, Buildroot, Yocto)

Leer Más / Read More...
SSHole: falla de OpenSSH en sistemas con musl (Alpine, OpenWrt, Buildroot, Yocto)
Haz clic para acceder al contenido completo.
blog.segu-info.com.ar
November 5, 2026 at 4:42 PM
bearstech.com
SSHole : une faille critique dans OpenSSH restée cachée pendant dix ans (via Pierre Arlais)

Donc go installer la mise à jour de sécurité OpenSSH 10.6p2.

👉 https://sshhole.com/
*sshole so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016. accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters. yes, any password. yes. i know. yes. $ ssh root@alpine-cloud root@alpine-cloud's password: wrong Permission denied, please try again. root@alpine-cloud's password: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Welcome to Alpine! alpine-cloud:~# id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) alpine-cloud:~#
November 5, 2026 at 1:07 PM
ytroncal.bsky.social
*sshole : so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016. sshhole.com
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 8, 2026 at 2:04 PM
osrepos.bsky.social
ZimaOS: Run a Home NAS on Zima or x86-64 Hardware
https://osrepos.com/repo/icewhaletech-zimaos?utm_source=bluesky

ZimaOS is a Buildroot-based NAS operating system evolved from CasaOS, with OTA updates and disk-management features.

#opensource
ZimaOS: Run a Home NAS on Zima or x86-64 Hardware
ZimaOS is a Buildroot-based NAS operating system evolved from CasaOS, with OTA updates and disk-management features. It targets Zima hardware and UEFI x86-64 systems, and is currently presented as a public evaluation program.
osrepos.com
November 4, 2026 at 12:50 PM
slashdot.org

OpenSSH Flaw Lets Attackers Log Into Password-Disabled Linux Accounts

https://it.slashdot.org/story/26/11/05/2140208/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts?utm_source=rss1.0mainlinkanon&utm_medium=feed
OpenSSH Flaw Lets Attackers Log Into Password-Disabled Linux Accounts
A newly disclosed OpenSSH flaw dubbed "*sshole" can allow attackers to log in to password-disabled accounts on certain musl-based Linux systems simply by submitting a password longer than 256 bytes. "Apparently certain varieties of musl Linux (Alpine, OpenWrt, Buildroot, Yocto, etc.) have had this O...
it.slashdot.org
November 5, 2026 at 10:12 PM
dougmerritt.mathstodon.xyz.ap.brid.gy
wtf wtf wtf are you wtkidding me?

Any password at all is accepted as long as it's over 256 characters!?!?!?

[With some extra conditions:]

> openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016 […]
Original post on mathstodon.xyz
mathstodon.xyz
November 5, 2026 at 5:57 PM
xavier.infosec.exchange.ap.brid.gy
so openssh on musl linux (alpine, openwrt, buildroot, yocto, and a lot of the docker images you've pulled) has had a little problem since 2016.

accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take […]
Original post on infosec.exchange
infosec.exchange
November 5, 2026 at 3:54 PM
lea-linux.org
Hey... pssssst....psssssst: sshhole.com
$ ssh root@alpine-cloud root@alpine-cloud's password: wrong Permission denied, please try again. root@alpine-cloud's password: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA Welcome to Alpine! alpine-cloud:~# id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) alpine-cloud:~# are you affected? is your sshd running on musl? (alpine, openwrt, buildroot, yocto) is it not using pam? alpine's openssh-server doesn't by default, or maybe you set UsePAM no are password logins still on? they are by default is there an account with just * as its password? key-only users, ldap users, root on alpine and some other account with a real password? then that * account takes any password between 257 and 1024 characters on alpine's official aws and azure images that's the default alpine user, and it has passwordless doas. so it's root on debian, ubuntu, fedora or anything else with glibc? going through pam? dropbear? openbsd? you're fine
November 5, 2026 at 12:41 PM
chromarock.bsky.social
openwrtやbuildroot、yoctoにも言及されてたけど、もしsshdを入れる場合、これらのデフォルトsshdは軽量のdropbareを使うので、わざわざopensshのsshdを入れた環境というレア環境だろうなぁと
November 6, 2026 at 12:48 AM
tweakers.net.web.brid.gy
Software-update - Home Assistant OS 18.5
Versie 18.5 van Home Assistant OS is uitgekomen. Home Assistant OS is een minimaal, op Buildroot gebaseerd besturingssysteem dat het mogelijk maakt om op een fysieke of virtuele machine Home Assistant te draaien. In versie 18.5 is de Linux-kernel bijgewerkt naar versie 6.18.59, wat daarmee een beveiligingsprobleem verhelpt. De releasenotes voor deze uitgave zien er als volgt uit: Changes
tweakers.net
November 7, 2026 at 10:53 AM
capitoledulibre.org
Merci à Bootlin, partenaire Platine du #cdl2026 ! Experts de Linux embarqué (noyau, Buildroot, Yocto), contributeurs upstream et formateurs, Bootlin publie ses supports de formation sous licence libre. On se voit les 14 & 15 novembre à Toulouse. bootlin.com
Visuel orange Capitole du Libre. Au centre, le logo Bootlin sur fond blanc. Bandeau « Merci à notre partenaire Platine ». En bas : Capitole du Libre, 14 & 15 novembre 2026, Toulouse, #cdl2026.
November 4, 2026 at 10:47 AM
lambdafu.bsky.social
If you deploy alpine, openwrt, buildroot, yocto or docker image based on that, or musl libc, with opensshd, you might be affected by this serious login vulnerability, where an attacker can use any long passwords to get root access. sshhole.com 1/2
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 5, 2026 at 3:49 PM