An urgent patch has been released for the password vulnerability in OpenSSH

A bug that completely bypassed password authentication on OpenSSH servers was fixed in version 10.6p2, released on November 5. CISA added the same flaw to the KEV catalog on November 9 and set November 12 as the patch deadline for federal agencies. The issue is tracked as CVE-2026-123158, with a CVSS score of 8.1 in the NVD.

The problem shows up on Linux installations where sshd checks passwords without PAM and the system uses musl libc. The best-known example of that combination is Alpine Linux. If an attacker knows the name of an account whose password field is an asterisk (*), they can log in with any password between 257 and 1024 bytes long. One attempt is enough; no retry is needed.

Where the bug comes from

When sshd runs without PAM, it hashes the password with crypt() and compares it to the stored value. If the account’s password field is too short, sshd borrows the salt from another account. musl’s crypt() function, meanwhile, returns “*” as an error indicator for keys longer than 256 bytes, which is exactly the character stored in the password field of accounts without a password. When the two asterisks match, the login is treated as successful. musl intentionally changed this behavior in 2012 to return an asterisk instead of NULL.

Who is affected

Three conditions have to be true at the same time: sshd must be built with musl and have PAM disabled, PasswordAuthentication must be enabled (the OpenSSH default), and the system must have an account whose password field is an asterisk. In addition, at least one account must have a real password hash starting with $5$ or $6$. On Alpine, the root account has shipped as root:* since 3.16; users who log in only with keys, accounts coming from a directory service, and the alpine user in tiny-cloud images are in the same situation. In Alpine’s official cloud images (from 3.18.11 through 3.24.3), the alpine user has passwordless doas privileges, which effectively means direct root access.

The Alpine team has released fixed packages for every version from 3.16 through 3.24. OpenWrt, Buildroot, and Yocto-based embedded systems that use musl are also at risk when the same conditions are met. Docker users who do not run sshd inside containers, those with password logins disabled, and those using PAM are not affected.

How to fix it

On Alpine, apk upgrade -U -a is enough; the fixed packages are in versions 3.21.10, 3.22.8, 3.23.8, and 3.24.4. Updating the package does not replace a running sshd, so rc-service sshd restart is required afterward. For anyone who cannot update immediately, the quickest workaround is to disable password logins: add the line PasswordAuthentication no to /etc/ssh/sshd_config.d/00-no-passwords.conf and restart sshd. Details are in the OpenSSH 10.6p2 release notes.

Are there signs of compromise?

On Alpine, you should search for “Accepted password” lines in /var/log/messages. If an account without a password (alpine, root, or a user who normally logs in only with a key) appears to have logged in with a password, treat the machine as compromised; investigate unauthorized keys, new users, and doas logs.

Source: CISA KEV · NVD