# Critical Alpine Linux OpenSSH Flaw Allows Unauthorized Server Access A single character error in musl library enables remote authentication bypass on vulnerable systems. - **Source:** [ZDNET](https://www.zdnet.com) - **Published:** 2026-11-07 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/ad69b853-c8de-4796-9147-2c52efa76565 ## Critical Authentication Bypass Alpine Linux faces a severe security vulnerability, identified as CVE-2026-123158, allowing attackers to bypass SSH authentication. By targeting the server's SSH port, unauthorized users can gain access with a single connection attempt. This flaw requires no retries, making it an extremely efficient exploit for compromising lightweight Linux server environments. ## The Single Character Trigger The vulnerability stems from the musl C library's crypt function. When a password exceeds 256 bytes, the function returns an asterisk as an error indicator. Because passwordless accounts also store an asterisk in their password field, the system incorrectly validates the long password as a match, granting the attacker immediate access. ## Scope of Vulnerability While Alpine Linux is the primary focus, other musl-based distributions are potentially affected. Systems including Adélie Linux, Void Linux, Sabotage Linux, OpenWrt, and the Yocto Project are under review. Unlike standard glibc-based systems, which return NULL on error, these distributions remain uniquely susceptible to this specific character-based authentication bypass mechanism. ## Exploitation Requirements To successfully exploit the system, an attacker needs the target account name and the presence of at least one other account with a hashed password on the machine. Once these conditions are met, sending a password between 257 and 1,024 bytes allows the attacker to bypass security for any passwordless account. ## Impact on Cloud Images Alpine's official tiny-cloud images, versions 3.18.11 through 3.24.3, are identified as particularly vulnerable. These images ship with an alpine user containing a wildcard password field and passwordless doas access. While safe on first boot, they become exploitable as soon as any hashed password is added to the system by administrators. ## Remediation and Patching Alpine has released updated packages for all supported branches, including 3.21.10, 3.22.8, 3.23.8, and 3.24.4. Administrators must run 'apk upgrade -U -a' and restart the sshd daemon to apply the fix. Simply updating the package is insufficient; the daemon process must be explicitly restarted to ensure the patch is actively running. ## Immediate Mitigation Steps For systems that cannot be immediately patched, Alpine advises setting 'PasswordAuthentication no' in the SSH configuration. After modifying this setting, administrators must restart the sshd service. It is critical to verify that key-based authentication remains functional before disabling password authentication to avoid locking out legitimate administrative access to the server. ## Forensic Security Assessment Administrators should audit logs for 'Accepted password for' entries involving accounts without passwords. If any suspicious logins are identified, the machine must be treated as fully compromised. Reviewing doas usage, recently created users, and authorized keys is essential to determine if an attacker has already leveraged this long-standing latent flaw. ## Sources covering this story - https://www.zdnet.com/tech/alpine-linux-openssh-patch-flaw/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._