OpenSSH password bypass on Alpine musl systems without PAM
Identifiers: OpenSSH-musl-password-bypass-2026-11-05
- Published
- Last substantive change
- Last verified
Last verified: . Attention items are due for re-verification within 72 hours.
Summary
Alpine Linux and OpenSSH published notices on 5 November 2026 about a password authentication bypass on musl-based Linux without PAM. The vendor notice lists no CVE. Fixed Alpine packages and the upstream 10.6p2 workaround are available.
Impact
An attacker who can reach SSH and knows a username may log in to an account meant to accept keys only. The default PermitRootLogin prohibit-password setting still blocks direct root password login.
Who is affected
Alpine openssh-server or openssh-server-pam with UsePAM no and PasswordAuthentication yes, the target account's password field set to * and another account holding a $5$ or $6$ hash, with SSH reachable from the network. Alpine checked 3.16 to 3.24 and edge. Non-Linux, glibc and PAM-authenticated setups and containers without sshd are outside this issue.
Products and versions
| Products and versions | Affected | Fixed |
|---|---|---|
| OpenSSH on Alpine Linux / musl | Alpine 3.16–3.24 and edge before branch-specific fixed packages; musl, PAM disabled and password/account prerequisites apply. Exact upstream affected range not established. | OpenSSH 10.6p2; Alpine edge 10.6_p2-r0; 3.24: 10.3_p1-r2; 3.23: 10.2_p1-r1; 3.22: 10.0_p1-r11; 3.21: 9.9_p2-r1; 3.20: 9.7_p1-r6; 3.19: 9.6_p1-r3; 3.18: 9.3_p2-r4; 3.17: 9.1_p1-r7; 3.16: 9.0_p1-r6 |
Exploitation evidence
Exploitation not established. The primary notices reviewed on 6 November 2026 do not establish in-the-wild exploitation. The researcher write-up is public.
Actions
- Install the patched package for your Alpine branch from the vendor table now (edge: 10.6_p2-r0) and restart sshd promptly in a controlled change that keeps your current session and access intact; updating the package alone does not activate the fix.
- If patching must wait, first confirm that SSH key login works and that a recovery route exists, keep the current session open, then set PasswordAuthentication no, validate the config, restart in a controlled way and test a fresh key login before relying on the change.
- Review accepted password logins to key-only accounts and privileged changes; treat suspected compromise as a separate investigation.
Unknowns
- The notices give no exact affected range across all upstream OpenSSH versions.
- No in-the-wild exploitation is established, which is not proof that none exists.
Sources
- Alpine Linux https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
- OpenSSH https://www.openssh.org/releasenotes.html
- Özgün Kültekin / Wakefield https://sshhole.com/
Change history
- — Published: Added 6 November 2026 from the Alpine and OpenSSH notices of 5 November 2026.