A significant security vulnerability in OpenSSH has been identified, potentially allowing remote attackers to bypass password authentication on certain Alpine Linux servers. This flaw particularly affects systems that use musl libc without PAM (Pluggable Authentication Modules). OpenSSH has addressed this issue with the release of Portable 10.6p2 on November 5, 2026.
Understanding the Security Flaw
Research by Özgün Kültekin, published on sshhole.com, outlines how an extensive password can convert a failed authentication attempt into a successful one. The vulnerability requires a single connection, access to an SSH port, and knowledge of an account name. For exploitation, the target account must have an asterisk (*) in its password field, while another account needs a password hash starting with $5$ or $6$.
The flaw becomes exploitable when password authentication is enabled, compromising accounts initially set for key-only access. Alpine’s standard configuration lacks PAM, heightening the risk unless the openssh-server-pam package with UsePAM is employed. Containers without active SSH servers remain secure.
Technical Analysis of the Exploit
The vulnerability stems from an interaction between OpenSSH and musl’s crypt() function. When PAM is absent, sshd hashes the entered password and compares it to the stored password field. If the target account’s field contains only *, sshd uses another account’s salt, leading to a successful login with an abnormally long password.
Passwords exceeding 256 bytes trigger musl’s error-handling mechanism, which returns * as an error marker. This matches the stored field of the target account, allowing authentication. Alpine identified passwords between 257 and 1024 bytes as susceptible, with a sequence of 300 ‘A’ characters being particularly effective.
Addressing and Mitigating the Risk
Alpine has issued guidance to mitigate this risk, recommending users execute apk upgrade -U -a and restart the sshd service. Fixed versions include 3.21.10, 3.22.8, 3.23.8, and 3.24.4, with patches for older versions available. Systems should be considered compromised if unauthorized access cannot be ruled out.
For immediate protection, administrators can disable password authentication by setting PasswordAuthentication to no, ensuring key-based access is functional, and restarting sshd. Monitoring /var/log/messages for unusual passwordless account activity is advised to detect and respond to potential threats.
This vulnerability highlights the importance of regular software updates and security audits to protect against emerging cyber threats. By following the recommended actions, administrators can secure their systems against this critical flaw.
