Alpine fixes OpenSSH flaw that allowed passwordless logins

Alpine Linux has issued an urgent advisory on 5 November 2026 describing an OpenSSH authentication bypass that can let attackers log in to sshd without a password. The vulnerability affects OpenSSH builds using the musl C library with PAM disabled, and can be triggered on passwordless accounts that nonetheless store a password field.

Alpine states that every affected release from 3.16 through 3.24 and edge is impacted, and that the issue is exploitable via sshd with a passwordless account bearing at least one hash of type $5$ or $6$ (SHA-256/SHA-512 family). Evidence cited includes testing across thousands of logins and configurations, with a root cause traced to musl’s crypt() returning a failure string that can be misinterpreted as a valid hash when a password field is empty. At the time of report, Alpine, OpenSSH and the researcher noted no public exploit code or in-the-wild exploitation, and no CVE had been assigned.

The fix, according to the advisory and the OpenSSH release notes, is to upgrade OpenSSH to version 10.6p2 and restart sshd, noting that merely upgrading the package may not replace the running daemon. If updating is not possible, Alpine recommends disabling PasswordAuthentication and restarting sshd.

The write‑up by the Wakefield-based researcher behind the related “*sshole” analysis further explains the broader risk to musl-based systems and to containers based on Alpine, while highlighting that cloud images with passwordless users remain particularly vulnerable. Alpine also indicates that systems using openssh-server-pam with UsePAM yes are not affected, and that non‑sshd containers are safe.