OpenSSH password bypass affects Alpine servers using musl without PAM
Original title: OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Servers
Portable OpenSSH 10.6p2 adds a workaround; Alpine fixes include 3.21.10, 3.22.8, 3.23.8 and 3.24.4, with no CVE assigned.
A password-authentication bypass can let a remote attacker log into certain Alpine Linux SSH servers without the password when musl libc is used and PAM is disabled. The account must store * in its password field, and another local account must hold a $5$ or $6$ hash. Alpine’s standard openssh-server package is built without PAM. Fixed Alpine releases are out; administrators must restart sshd after installing them.
Unconfirmed: Alpine had not assigned a CVE when it published the advisory, and real-world exploitation is not described.
- Exploitation needs one connection, a known account name, and SSH access.
- Tiny-cloud images from Alpine 3.18.11 through 3.24.3 can be affected.
- Those images’ alpine account has a * field and passwordless doas.
- PasswordAuthentication no, or UsePAM yes, is not affected.
- Özgün Kültekin of Wakefield reported the issue.
Impact: passwordless remote login, potentially root via doas
| Product | Affected | Fixed in |
|---|---|---|
| OpenSSH Portable OpenSSH | — | 10.6p2 |
| Alpine Linux | tiny-cloud images 3.18.11 through 3.24.3; openssh-server without PAM | 3.21.10, 3.22.8, 3.23.8, and 3.24.4 |
- 1.Install Alpine’s fixed packages and restart sshd.
- 2.If patching must wait, set PasswordAuthentication no and restart sshd.
- 3.Review logs for accepted passwords on passwordless accounts and unexpected doas activity.
- Vendors
- Alpine
- Products
- OpenSSHAlpine Linux
From the original article
2 min read at cybersecuritynews.com
A critical OpenSSH password authentication bypass could let remote attackers access affected Alpine Linux servers without knowing a password. Portable OpenSSH 10. 6p2, released on November 5, 2026, adds a workaround for the flaw, which affects certain Linux systems using musl libc when PAM support is disabled.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.