Alpine Linux OpenSSH patch targets flaw exposing passwordless accounts on vulnerable servers, ZDNet reports

A single connection can succeed

The vulnerability, CVE-2026-123158, can allow an attacker who reaches a vulnerable server’s SSH port to log in without a valid password. Alpine’s advisory says the attack can work with one connection and requires no retries.

The flaw applies to Alpine systems using the default openssh-server package without PAM, or openssh-server-pam configured with UsePAM no. PasswordAuthentication must also be enabled, and the attacker needs the name of a passwordless account.

How the password check fails

Without PAM, OpenSSH checks password attempts using the C library’s crypt() function and compares the result with the account’s stored password field. On musl systems, a password longer than 256 bytes makes crypt() return an asterisk as an error indicator.

Passwordless accounts also use an asterisk in that field, so the values can match. The attack requires a password 257 to 1,024 bytes long and at least one other account with a password hash beginning with 5 or 6, according to the report.

Affected systems and releases

Alpine says all releases it checked are affected, including versions 3.21 through 3.24, edge, and older branches from 3.16 to 3.20. Other musl-based systems that may be vulnerable include Adélie Linux, Void Linux, Sabotage Linux, OpenWrt, an Android variant and the Yocto Project.

The same attempt returns NULL on error with glibc’s crypt(), which OpenSSH rejects. The article says Debian, Ubuntu and Fedora are therefore not affected by this flaw.

Cloud images and root access

Alpine identified official tiny-cloud images from versions 3.18.11 through 3.24.3 as especially vulnerable. They include an alpine account with an asterisk password field and passwordless doas; the images become exploitable once an account with a 5 or 6 hash exists.

Root is generally not directly exposed because OpenSSH’s default PermitRootLogin prohibit-password setting blocks it. However, access to another account that can become root, including through doas, can provide a route to root.

Other vendor response

Wind River said it is reviewing the vulnerability and assessing its potential impact. A company representative said Wind River would take appropriate action as needed. The group *sshole uncovered the issue, which the report describes as a side effect that had remained hidden since 2016.