OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Servers - CyberSecurityNews
A critical OpenSSH flaw discovered on November 5, 2026, enables remote attackers to bypass password authentication on vulnerable Alpine Linux servers, potentially compromising accounts intended for key-only access.
The vulnerability allows attackers to successfully log into accounts with a * in the password field when another local account contains a $5$ or $6$ password hash. Exploitation requires only one connection, a reachable SSH port, and a known account name when the specific conditions exist. This means adding a password to one account can inadvertently expose other accounts created without passwords.
Technical Details
The flaw stems from an interaction between OpenSSH and musl's crypt() function. When a submitted password exceeds 256 bytes, musl's password-hashing code rejects it and returns * as an error marker. This marker matches the target account's stored field, causing the authentication check to succeed instead of failing. Alpine has identified passwords between 257 and 1024 bytes as the trigger for this vulnerability.
A password consisting of 300 repeated 'A' characters could bypass authentication for an affected account. The password does not need to match a real secret.
Affected Systems
Alpine's standard openssh-server package doesn't use PAM, making certain configurations vulnerable. Systems using openssh-server-pam with UsePAM yes are not affected. Containers without a running SSH server are also safe, meaning using an Alpine container image alone doesn't establish exposure. Official Alpine tiny-cloud images from versions 3.18.11 through 3.24.3 contain an alpine account with passwordless doas access, making them potentially exploitable when a qualifying password hash is added.
Remediation Steps
Users should follow Alpine's guidance by running 'apk upgrade -U -a' followed by 'rc-service sshd restart'. Updating alone leaves the old daemon running. Fixed releases include 3.21.10, 3.22.8, 3.23.8, and 3.24.4, with patched packages available for older branches. Where patching must wait, administrators should set PasswordAuthentication to no, confirm key-based access works, and restart sshd while keeping an existing session open.
Alpine advises treating machines as compromised when unauthorized access cannot be ruled out. The OpenSSH release notes confirm the upstream workaround, and the vulnerability is distinct from earlier OpenSSH client and server vulnerabilities involving interception and service disruption.
Related
