Alpine Linux OpenSSH Auth Bypass: Update Now
Original: Alpine Linux Security Advisory: OpenSSH-server password authentication bypass
Why This Matters
Password-less SSH bypass with no CVE yet means unpatched servers stay exposed longer.
Alpine Linux disclosed a critical OpenSSH vulnerability on Nov 5, 2026: attackers can log in without a password by sending a 257–1024 byte string, targeting accounts with '*' in the password field. All releases from 3.16 to 3.24 are affected.
Alpine Linux issued a security advisory warning that any attacker who can reach an exposed SSH port can authenticate without a password—no brute force, no retries, one connection. The attack requires knowing the name of an account whose shadow password field is '*' (standard for key-only accounts) and the existence of at least one local account with a $5$ or $6$ SHA-256/SHA-512 hash. Sending a long password between 257 and 1024 bytes triggers the bypass.
Affected systems include any Alpine host running openssh-server (built without PAM) or openssh-server-pam with UsePAM no, where PasswordAuthentication is yes (the OpenSSH default). Every Alpine release from 3.16 through 3.24 and edge are confirmed affected. The root account is technically vulnerable but protected by default PermitRootLogin prohibit-password—unless that setting was changed, or a doas-capable account is targeted instead.
Fixed package versions are available: edge gets 10.6_p2-r0, while stable branches receive backported patches down to 3.16. Critically, upgrading the package does not restart the running sshd daemon—admins must manually run rc-service sshd restart after patching. No CVE had been assigned at time of publication. Cloud-init images and containers not running sshd are not affected.