Alpine Linux and OpenSSH patch flaw that's as bad as it can get

A critical OpenSSH authentication bypass, CVE-2026-123158, affects Alpine Linux and potentially other musl-based systems when OpenSSH runs without PAM and password authentication is enabled. An attacker who knows the name of a passwordless account can send a password 257-1,024 characters long. Musl’s password-hashing function returns “*” for an overlong input, matching the marker stored for accounts without passwords, so SSH accepts the login. The attack works reliably in one connection if the machine also has an account with a conventional password hash. Root is usually protected by OpenSSH’s default settings, but an account that can gain root privileges may still provide a path to takeover. Systems using glibc, including Debian, Ubuntu, and Fedora, are not affected by this flaw.

Alpine says affected releases include versions 3.16 through 3.24 and edge, provided the vulnerable SSH and account settings are present; tiny-cloud images are especially exposed once a password hash is added. Systems without sshd, with password authentication disabled, or using PAM correctly are not vulnerable. Alpine has issued fixed packages and releases, while OpenSSH 10.6p2 also addresses the problem. Administrators should upgrade with `apk upgrade -U -a` and restart sshd, since upgrading alone leaves the running daemon unchanged. If an update is not possible, disable password authentication after confirming key-based access works. Check logs for accepted password logins to passwordless accounts and review privilege-tool use, new users, files, and SSH keys; if an intrusion cannot be ruled out, treat the system as compromised.