A newly disclosed OpenSSH flaw can let a remote attacker log in to certain passwordless accounts on Alpine Linux and other musl-based systems by sending an oversized password.
Tracked as CVE-2026-123158 and rated High with a CVSS 3.1 score of 8.1, the bug affects sshd when it runs with musl libc and without PAM, while SSH password authentication remains enabled. The target must also have an account whose password field is * and at least one other account with a $5$ or $6$ password hash. The attacker needs network access to the SSH service but does not need a valid password.
The bypass stems from how musl’s crypt() function handles passwords longer than 256 bytes. It returns an asterisk (*) as an error marker, which can match the same character stored for accounts that have no usable password hash. Under the affected conditions, sshd can mistake the failed hash operation for a successful login. The issue does not let attackers bypass valid password hashes. Systems using glibc, including Debian, Ubuntu and Fedora, are not affected, and neither are PAM-enabled configurations using UsePAM yes.
OpenSSH released version 10.6p2 on November 5 to block the authentication bypass. Alpine’s security advisory says releases 3.16 through 3.24 and edge are affected, and lists fixed package revisions for each branch: 10.6_p2-r0 on edge, 10.3_p1-r2 on 3.24, 10.2_p1-r1 on 3.23, 10.0_p1-r11 on 3.22, 9.9_p2-r1 on 3.21, 9.7_p1-r6 on 3.20, 9.6_p1-r3 on 3.19, 9.3_p2-r4 on 3.18, 9.1_p1-r7 on 3.17 and 9.0_p1-r6 on 3.16. The OpenSSH project described 10.6p2 as a critical security workaround for Linux systems using musl with PAM disabled in its release notes.
Alpine also warns that its official tiny-cloud images from 3.18.11 through 3.24.3 ship with an alpine account whose password field is * and passwordless doas privileges. Those images become exploitable once another $6$ password hash exists on the system, which can allow an attacker to obtain a shell as the alpine user and then elevate privileges through doas. Alpine says the sshd daemon must be restarted after applying the updated package because the running process is not replaced automatically.
The issue is separate from the SSH and Serve vulnerabilities fixed in Tailscale 1.104.4, which affected Tailscale’s own remote-access stack rather than OpenSSH’s password-verification path. OpenSSH credited researcher Özgün Kültekin with reporting the flaw.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
