An OpenSSH Password Bypass Puts Some Alpine Hosts at Risk
Portable OpenSSH 10.6p2 and new Alpine Linux packages address a password authentication bypass. The vulnerable path affects certain Linux systems that use musl and run SSH without PAM. On Alpine, an attacker who can reach the SSH service may be able to log in to a key-only account if password authentication is enabled and the system also has a local account with a susceptible password hash. OpenSSH release notes · Alpine advisory
Check the running service and its accounts
Alpine’s standard SSH server package is built without PAM. Its PAM-enabled package can also be affected if UsePAM is off. The distribution describes a combination of two account states: the target account has an asterisk in its password field, and at least one local account has a SHA-256 or SHA-512 crypt password hash. The default root-login policy restricts direct password logins as root, but a compromised key-only user could still have a path to root through its own privileges. Alpine also identifies some cloud images where later account configuration can introduce the missing condition. Alpine exposure guidance
Update and restart SSH
Alpine lists fixed packages including 10.3_p1-r2 on 3.24, 10.2_p1-r1 on 3.23 and 10.0_p1-r11 on 3.22. The upstream release number and the distribution’s package version can differ because fixes are backported. Restart the running SSH daemon after updating. If an immediate update is unavailable, Alpine advises disabling password authentication and restarting the daemon. Verify effective settings and that authorised key-based access works before closing the maintenance session. Alpine fixed packages and mitigation · BlackTree’s Alpine Linux lifecycle
Update, 9 November 2026
CISA added the flaw to its Known Exploited Vulnerabilities catalogue. The deadline for covered US federal agencies was set for 12 November, with forensic triage required. Operators with exposed servers should review SSH and downstream activity for unexpected successful logins in addition to installing the fix. CVE-2026-123158 · CISA catalogue
