OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

The emergency patch released on November 5, 2026, closes a surprisingly narrow but dangerous hole in OpenSSH when it runs on musl‑based Linux systems without PAM. The flaw doesn’t lie in OpenSSH’s own code; it lives in musl’s implementation of the classic crypt() function. Many Alpine, OpenWrt, Buildroot and Yocto images store the same "*" in /etc/shadow for accounts that are deliberately disabled, such as the default alpine user or root:*.

When OpenSSH’s sshd handles password logins directly (i.e., without delegating to PAM), it hashes the supplied password with crypt() and then does a straight string comparison with the shadow entry. Because both the computed value and the stored placeholder are "*", the comparison succeeds, granting access without any secret. The attack needs only a single connection; the password can be any string between 257 bytes and 1 KB, making brute‑force unnecessary.

The exposure is limited to three intersecting conditions: the server links against musl, password authentication is enabled, and at least one account on the host holds a real password hash. The latter supplies a valid salt that sshd reuses for the crypt() call, allowing the *‑match to occur for every * account. If an attacker can reach sshd over the network – a cloud VM, a jump host, or an embedded router – they can log in as the alpine user and, from there, often pivot to root.

Alpine’s own packages incorporate this upstream fix and also ship a back‑ported patch for older releases. The critical operational step, emphasized by the Alpine security advisory, is to restart the sshd daemon after updating; otherwise the old, vulnerable binary continues to accept connections. For systems that cannot be patched immediately, turning off PasswordAuthentication in sshd_config (and confirming key‑based access first) blocks the exploit, though administrators must beware of locking themselves out.

While the patch restores the expected behaviour, the underlying musl quirk remains unchanged, meaning future code that assumes a failed crypt() will never return "*" could re‑expose similar logic bugs. No CVE had been assigned at the time of the emergency release, and it is still referenced in media as CVE‑2026‑123158.

For now, the practical takeaway is clear: update OpenSSH to 10.6p2 (or later), restart sshd, and verify that password authentication is disabled unless you deliberately need it. The cost of a single lingering process outweighs the inconvenience of a quick service bounce, especially when the alternative is an open backdoor to any account marked with "*".