OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Servers

A critical OpenSSH password authentication bypass could let remote attackers access affected Alpine Linux servers without knowing a password. Portable OpenSSH 10.6p2, released on November 5, 2026, adds a workaround for the flaw, which affects certain Linux systems using musl libc when PAM support is disabled.

Alpine warns that exploitation needs only one connection and no repeated attempts when the required conditions are present. The attacker must know a suitable account name and reach the server’s SSH port. Alpine had not assigned a CVE identifier when it published the advisory.

The issue was reported by Özgün Kültekin of Wakefield. OpenSSH developers say the root cause sits outside sshd, the SSH server process, but attackers can trigger it through sshd. The new release blocks that path rather than treating the problem as a flaw affecting every OpenSSH installation.

This disclosure follows other recent OpenSSH updates, including OpenSSH 10.6 security fixes. However, administrators should assess this password bypass separately because its impact depends on the server’s library, authentication settings, and account records.

Alpine’s standard openssh-server package is built without PAM, the framework used to handle login checks. Servers running openssh-server-pam are also exposed when configured with UsePAM no. Password authentication must be enabled, and specific password records must exist before an attacker can exploit the flaw.

OpenSSH Flaw Bypass Password Authentication

According to Alpine’s security advisory, the target account must have * in its password field. At least one other local account must contain a $5$ or $6$ password hash. Accounts created for key-only access can therefore become targets even though their users never set passwords.

Without PAM, sshd uses the C library’s crypt() function to check passwords. For a stored field too short to hold a salt, it borrows another account’s salt. When given an overly long password, musl returns * as an error value. That value matches the target account’s stored field, allowing authentication.

The risk extends to official tiny-cloud images from Alpine 3.18.11 through 3.24.3. Their alpine account has a * password field and passwordless doas access. These images become exploitable after a qualifying password hash is added, potentially allowing an attacker to gain root privileges after login.

Unlike the earlier OpenSSH client and server vulnerabilities, this issue directly affects password checks. Systems with PasswordAuthentication no, or PAM-enabled servers using UsePAM yes, are not affected. Containers that do not run sshd are also outside the affected group.

Update and Restart SSH Immediately

Administrators should install Alpine’s fixed packages and restart sshd. Updating alone leaves the existing server process running. Fixed releases include Alpine 3.21.10, 3.22.8, 3.23.8, and 3.24.4.

Older branches also received patched packages, so a lower OpenSSH version number does not automatically mean a system remains vulnerable.

Where patching must wait, set PasswordAuthentication no, confirm key-based access works, and restart sshd while keeping an existing session open. Review /var/log/messages for Accepted password for entries involving passwordless accounts, then inspect unexpected doas activity and new authorized keys.

The OpenSSH release notes confirm the upstream workaround. Alpine advises treating machines as compromised when unauthorized access cannot be ruled out.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Servers appeared first on Cyber Security News.