Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (OpenSSH 10.6p2)
OpenSSH sshd on Alpine Linux (openssh-server, built without PAM)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Alpine Linux warned that sshd built without PAM can be logged into without a password. On those builds sshd checks a password by running crypt() and comparing the result to the stored password field, borrowing another account's salt when the stored field has none. musl's crypt() returns "*" as an error when the password is longer than 256 bytes, and "*" is exactly what the stored field holds for accounts with no password, so the comparison matches. An attacker who can reach the SSH port and knows the name of such an account can log in with one connection by sending a 257 to 1024 byte password, as long as the machine has at least one other account with a $5$ or $6$ hash. Affected setups are Alpine's openssh-server package (or openssh-server-pam with UsePAM no) with PasswordAuthentication yes, on every release Alpine checked from 3.16 through 3.24 and edge. OpenSSH released 10.6p2 on Nov 5 2026 to avoid the bug in sshd, and Alpine shipped fixed packages for 3.16 to 3.24 and edge. No CVE had been assigned when the advisory was published.
Why this severity: Unauthenticated login over SSH in one attempt to any account whose password field is "*", on non-PAM builds with PasswordAuthentication yes and at least one $5$/$6$ hash on the host; no CVE assigned yet; no exploitation reported
- Started
- Nov 5, 2026
Affected
- Alpine Linux 3.16 through 3.24 and edge: openssh-server (no PAM), or openssh-server-pam with UsePAM no, with PasswordAuthentication yes
- Official Alpine tiny-cloud images 3.18.11 through 3.24.3 (alpine user with * password and passwordless doas) once any $6$ hash exists on the machine
Fixed in
- OpenSSH portable 10.6p2
- Alpine edge openssh 10.6_p2-r0
- Alpine 3.24 openssh 10.3_p1-r2 (3.24.4)
- Alpine 3.23 openssh 10.2_p1-r1 (3.23.8)
- Alpine 3.22 openssh 10.0_p1-r11 (3.22.8)
- Alpine 3.21 openssh 9.9_p2-r1 (3.21.10)
- Alpine 3.20 openssh 9.7_p1-r6
- Alpine 3.19 openssh 9.6_p1-r3
- Alpine 3.18 openssh 9.3_p2-r4
- Alpine 3.17 openssh 9.1_p1-r7
- Alpine 3.16 openssh 9.0_p1-r6
Timeline2
OpenSSH releases portable 10.6p2 with a fix that avoids a password authentication bypass in sshd affecting some Linux systems built and run without PAM, reported by Özgün Kültekin of Wakefield.
Alpine Linux publishes its advisory and fixed openssh packages for 3.16 through 3.24 and edge, and says to restart sshd after upgrading or set PasswordAuthentication no.
Advisories2
Notes & caveats
Watch for a CVE assignment and for other musl-based distributions that ship sshd without PAM.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
