# Critical Authentication Bypass Vulnerability Found in Alpine Linux OpenSSH A password length flaw allows unauthorized access to accounts using asterisk-based authentication. - **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91) - **Published:** 2026-11-05 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/a1114896-0b77-414b-8dc5-433e445e090b ## The Core Vulnerability Alpine Linux systems running OpenSSH are vulnerable to an authentication bypass. When a user provides a password exceeding 256 bytes, the musl C library's crypt function returns an asterisk. Because accounts without passwords also store an asterisk in their shadow file, the system incorrectly validates the login attempt as successful. ## Exploitation Mechanism An attacker requires the name of an account with a locked password field, represented by an asterisk. By sending a password between 257 and 1024 bytes, the attacker triggers the crypt failure. If the machine contains at least one other account with a standard hash, the system borrows its salt, completing the bypass. ## Impact on Cloud Images Official Alpine cloud images, including AMI and VHD artifacts, are particularly exposed. These images often include an 'alpine' user with an asterisk password and passwordless doas privileges. Once an administrator adds a single user with a hashed password, the system becomes fully exploitable, potentially granting an attacker immediate root-level access. ## Scope of Affected Releases The vulnerability affects a wide range of Alpine versions, specifically releases 3.16 through 3.24, including the edge branch. While some versions have reached their end of support, maintainers have published patched packages for all these releases. Users must verify their specific version and apply the provided security updates immediately to mitigate risk. ## Immediate Remediation Steps Administrators should update OpenSSH to version 10.6p2 or the latest patched release via apk. Crucially, simply upgrading the package is insufficient; the sshd daemon must be restarted using rc-service sshd restart. If an immediate update is not possible, disabling password authentication in the sshd configuration serves as an effective temporary security measure. ## Configuration Hardening To disable password logins, set PasswordAuthentication no in the sshd configuration. On newer Alpine releases, this can be done by creating a drop-in file in /etc/ssh/sshd_config.d/. After modifying the configuration, run sshd -t to verify the syntax before restarting the service to ensure the changes take effect without locking out legitimate users. ## Forensic Review Requirements Security teams should inspect /var/log/messages for entries indicating accepted passwords for accounts that typically lack them, such as root or alpine. It is essential to review recent doas usage, newly created user accounts, and modified authorized_keys files. If any suspicious activity is detected, the machine should be treated as fully compromised. ## Broader System Context This issue highlights the risks of non-standard libc implementations like musl when interacting with complex software like OpenSSH. While most distributions use PAM, which avoids this specific crypt behavior, Alpine's direct reliance on musl created this unique failure point. The fix ensures that sshd no longer inadvertently validates passwords against error-indicator strings. ## Sources covering this story - [Hacker News (news.ycombinator.com) — The Sshole Vulnerability: Authentication Bypass in Alpine Linux](https://sshhole.com) - [Hacker News: Front Page — Critical OpenSSH Authentication Bypass Vulnerability in Alpine Linux](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) - [Hacker News — The Hidden Vulnerability in Alpine Linux SSH Authentication](https://sshhole.com) - [Hacker News — Critical OpenSSH Authentication Bypass Vulnerability in Alpine Linux](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) - [www.theregister.com - Articles — Critical OpenSSH Vulnerability Allows Root Access via Long Passwords](https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910) - [cybersecurity — OpenSSH Vulnerability Exposes Password-less Accounts on Musl Linux](https://www.reddit.com/r/cybersecurity/comments/1xojiq8/openssh_on_musl_linux_has_been_letting_people/) - [www.theregister.com - Articles (theregister.co.uk) — Critical OpenSSH Vulnerability Allows Root Access via Long Passwords](https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910) - [Blackhat Library: Hacking techniques and research — OpenSSH 10.6p2 Vulnerability Affects Alpine Linux Authentication](https://www.reddit.com/r/blackhat/comments/1xoqhjv/openssh_106p2_long_passwords_can_bypass_ssh_login/) - [Hacker News (news.ycombinator.com) — Alpine Linux Issues Critical OpenSSH Authentication Bypass Advisory](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) - [www.theregister.com - Articles — Critical Root Access Vulnerability Found in Musl-based Linux Systems](https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._