OpenSSH on musl (Alpine): password-auth bypass for `*`-password accounts via 257–1024-byte password (CVE-2026-123158)
Severity: high · Patch status: patched · Since 2026-11-05 · CVE-2026-123158
When sshd is built without PAM (Alpine's default openssh-server, or openssh-server-pam with UsePAM no), it checks a password by running crypt() on the attempt and comparing the result with the stored field. An account whose field is too short to hold a salt, such as (no password), gets the salt of another account with a $5$/$6$ hash. sshd has done this since a 2016 timing-attack mitigation (picksalt()). musl's SHA-crypt rejects keys over 256 bytes and returns the literal string as its error value. So a password of roughly 257–1024 bytes "hashes" to , matches the stored field, and logs the attacker in on the first try. Affected hosts need: PasswordAuthentication yes, any account with a password field, and at least one local account with a real $5$/$6$ hash. Accounts with include root (shipped as root: since about Alpine 3.16, but blocked by the default PermitRootLogin prohibit-password), key-only users, directory users from nslcd, winbind or sssd, and the alpine user with passwordless doas in tiny-cloud images 3.18.11–3.24.3. Every Alpine release from 3.16 to 3.24 and edge is affected. OpenSSH's maintainers say the root cause is outside sshd and shipped a workaround in 10.6p2 (2026-11-05); Alpine backported a patch to every branch back to 3.16 and cut point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4. The reporter is Özgün Kültekin of Wakefield, who calls the bug "sshole". Public lab/PoC repositories appeared within hours. There are no reports of in-the-wild exploitation so far. Hosts not affected: locked ! accounts, UsePAM yes, and glibc-based distros.
What to do
- Upgrade and restart sshd: `apk upgrade -U -a && rc-service sshd restart`. Upgrading the package does NOT restart the running daemon.
- Confirm the fixed openssh package for your branch: edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, 3.20 9.7_p1-r6, 3.19 9.6_p1-r3, 3.18 9.3_p2-r4, 3.17 9.1_p1-r7, 3.16 9.0_p1-r6. Non-Alpine musl/no-PAM builds: upgrade to OpenSSH 10.6p2.
- If you cannot patch now, set `PasswordAuthentication no`, run `sshd -t`, restart sshd, and check that `sshd -T | grep -i passwordauthentication` prints `no`.
- Hunt for prior use: search `/var/log/messages` (or your syslog) for `Accepted password for` on accounts that have no password (root, alpine, key-only and directory users). Review doas/sudo use, new users, authorized_keys and recently changed files. Treat a host as compromised if you cannot rule a login out.
- Rebuild Alpine-based VM and cloud images (tiny-cloud qcow2/VHD/AMI 3.18.11–3.24.3 ship an `alpine` user with `*` and passwordless doas) and any container images that run sshd with password authentication.
- Inventory other musl/no-PAM sshd builds (OpenWrt/Buildroot/Yocto images that ship OpenSSH rather than Dropbear, postmarketOS) and lock no-password accounts with `!` instead of `*` where possible.
Fixed versions
- OpenSSH portable 10.6p2
- Alpine openssh: edge 10.6_p2-r0 · 3.24 10.3_p1-r2 · 3.23 10.2_p1-r1 · 3.22 10.0_p1-r11 · 3.21 9.9_p2-r1 · 3.20 9.7_p1-r6 · 3.19 9.6_p1-r3 · 3.18 9.3_p2-r4 · 3.17 9.1_p1-r7 · 3.16 9.0_p1-r6
- Alpine point releases 3.21.10, 3.22.8, 3.23.8, 3.24.4 (and images built from them)
Sources
All live incidents on Threat Watch
