Alpine Linux has issued an urgent security advisory regarding a severe vulnerability in its OpenSSH implementation that allows attackers to gain unauthorized access to servers with a single connection attempt. The flaw, tracked as CVE-2026-123158, exploits a specific behavior in the musl C library that causes password authentication checks to fail in a way that inadvertently grants access.
How the Authentication Bypass Works
The vulnerability affects systems running Alpine Linux or other distributions that utilize the musl libc library, such as Adélie Linux, Void Linux, Sabotage Linux, OpenWrt, and the Yocto Project. The issue arises when OpenSSH is configured without Pluggable Authentication Modules (PAM) and PasswordAuthentication is enabled.
Security engineer Gregory Bryant highlighted the simplicity of the exploit in a LinkedIn post, noting that while most authentication bypasses rely on complex logic chains, this vulnerability comes down to a single character. When an attacker sends a password between 257 and 1,024 bytes long to a server with a key-only account, the musl crypt() function returns an asterisk (*) as an error indicator. This matches the asterisk stored in the password field for accounts without passwords, causing the system to accept the login.
Systems using the standard glibc library, which includes Debian, Ubuntu, and Fedora, are not affected because their crypt() function returns NULL on error, a value that OpenSSH correctly rejects.
Widespread Impact and Affected Versions
Alpine Linux confirmed that every release it checked is vulnerable, including versions 3.21 through 3.24, the edge branch, and older 3.16 to 3.20 branches. The company specifically identified its official tiny-cloud images, versions 3.18.11 through 3.24.3, as especially vulnerable. These images ship with an alpine user that has a password field set to an asterisk and passwordless doas access.
While these cloud images are safe on first boot, they become exploitable once any user with a hashed password is created on the machine. This can happen when an administrator sets a console password or when user data adds a new user with a hashed password. Wind River, which produces the commercial embedded Linux distro Wind River Linux, is also reviewing the issue and assessing its potential impact.
The flaw has been hiding since 2016, according to *sshole, the group that uncovered the problem. To exploit it, an attacker only needs the name of a key-only account and at least one other account on the machine with a 5 or 6 character password hash. According to Alpine, one user with a password is enough to make every passwordless account accessible.
Patch and Mitigation Steps
Alpine Linux released fixed packages for OpenSSH 10.6p2 and patched versions for all stable branches back to 3.16. The company stressed that upgrading the package does not replace the running daemon, so administrators must restart the service manually. Users should run apk upgrade -U -a and then restart the daemon with rc-service sshd restart.
For those unable to update immediately, Alpine advised setting PasswordAuthentication to no and restarting sshd after confirming that key login works. Administrators should also search /var/log/messages for “Accepted password for” lines that name an account with no password. If a login cannot be ruled out, the machine should be treated as compromised.
Source: ZDNet
