openssh on musl linux has been letting people into password-less accounts since 2016.

OpenSSH 10.6p2 umgeht einen Bug, der zwar schwerwiegend ist, aber eher wenige Setups betrifft – und wohl auch nicht in OpenSSH selbst liegt.

Combining the NetBSD kernel with the Alpine Linux userland

Attackers log in with any password over 256 characters on musl systems like Alpine. Who is affected, what intruders did and how to check your server.

Alpine Linux

Overly long passwords can bypass authentication. OpenSSH fixes it in 10.6p2. Alpine Linux and others affected.

A November 2026 OpenSSH authentication bypass can expose specific Alpine and musl-based SSH servers. Learn the affected conditions, observed attack activity, patch versions and required restart step.

Urgent: Immediately set 'PasswordAuthentication no' in /etc/ssh/sshd_config and restart the sshd service. Make sure you have ssh key authentication or other ways to access your machines. Also make sure to update openssh to the latest version. The openssh fix will be backported all the way back to Alpine 3.16 https://openssh.org/releasenotes.html#10.6p2 #security #AlpineLinux

CVE-2026-123158 permite login sin contraseña en Alpine Linux. Ya hubo explotación activa en menos de 9 horas. Te contamos cómo parchear.

Urgent: Immediately set 'PasswordAuthentication no' in /etc/ssh/sshd_config and restart the sshd service. Make sure you have ssh key authentication or other ways to access your machines. Also make sure to update openssh to the latest version. The openssh fix will be backported all the way back to Alpine 3.16 https://openssh.org/releasenotes.html#10.6p2 #security #AlpineLinux

Malicious actors began exploiting a newly disclosed secure shell flaw in less than nine hours. Specifically, threat groups targeted the critical OpenSSH SSHole vulnerability across global internet infrastructure. Researchers confirmed active penetration attempts against realistic decoy systems running Alpine Linux. Furthermore, attackers successfully seized root privileges on compromised nodes. Consequently, system administrators must apply available vendor patches immediately to safeguard operational environments.