OpenSSH flaw allows access to password-disabled accounts on musl Linux
Original title: OpenSSH flaw lets attackers access password-disabled accounts on some Linux systems
Attackers bypass authentication on Alpine Linux cloud images by sending long passwords; emergency fix in OpenSSH 10.6p2.
A critical flaw in OpenSSH servers on systems using the musl C library lets remote attackers log into password-disabled accounts. The bug has existed for ten years but was discovered by a researcher and disclosed recently. Alpine Linux cloud images are exposed in default configurations, allowing command execution as root after login. The OpenSSH maintainers released an emergency update despite not considering the issue part of their code.
- Exploit works by sending passwords 257 to 1024 characters long
- Requires musl C library, no PAM support, and enabled password auth
- Default on Alpine Linux with doas privileges for alpine user
- Check logs for "Accepted password" entries to detect compromise
Impact: remote authentication bypass to disabled accounts
| Product | Affected | Fixed in |
|---|---|---|
| Alpine Linux OpenSSH | pre-10.6p2 | 10.6p2 |
- 1.Update OpenSSH to version 10.6p2
- 2.Disable password-based authentication
- 3.Set up key-based authentication only
- CVEs
- CVE-2026-123158
- Vendors
- Alpine LinuxOpenSSH
- Products
- musl
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 1% | PoC ×13 |
From the original article
4 min read at csoonline.com
A critical vulnerability that affects OpenSSH servers on Linux systems built with the musl C library instead of glibc allows remote attackers to easily bypass authentication and log into accounts that should have password authentication disabled. The flaw impacts the lightweight Alpine Linux, which is widely used for cloud Docker container images, as well as Linux distributions for embedded systems.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.