OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Servers

What happened?

A critical OpenSSH password authentication bypass could let remote attackers access affected Alpine Linux servers without knowing a password. Portable OpenSSH 10.6p2, released on November 5, 2026, adds a workaround for the flaw, which affects certain Linux systems using musl libc when PAM support is disabled. Alpine warns that exploitation needs only one connection and no repeated attempts when the required conditions are present. The attacker must know a suitable account name and reach the server’s SSH port. Alpine had not assigned a CVE identifier when it published the advisory.

Key details

• OpenSSH password authentication bypass allows remote access without a password on Alpine Linux servers.
• Flaw affects systems using musl libc when PAM support is disabled in OpenSSH configuration.
• Target account must have an asterisk in its password field and another local account must have a $5$ or $6$ hash.
• Official Alpine tiny-cloud images 3.18.11 through 3.24.3 are at risk due to the alpine account configuration.
• Systems with PasswordAuthentication disabled or PAM enabled with UsePAM yes are not affected.
• OpenSSH 10.6p2 released November 5, 2026 adds a workaround blocking the exploitation path through sshd.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.