Password Authentication Bypass in OpenSSH on Alpine Linux

A high severity vulnerability has been reported in Alpine Linux affecting versions 3.16 to 3.24 and edge, related to the password authentication bypass in OpenSSH on Alpine Linux. The notice was issued on November 6, 2026, by INCIBE-CERT, following a notification from Özgün Kültekin from Wakefield.

Details of the Vulnerability in OpenSSH on Alpine Linux

The vulnerability affects OpenSSH packages in Alpine Linux prior to the corrected versions indicated by the vendor. It occurs under these specific conditions: the server uses openssh-server without PAM or openssh-server-pam with the option UsePAM no; password authentication is enabled; there is an account whose password field contains the character *; and another local account has a password hash formatted as $5$ or $6$.

Under these circumstances, an attacker with access to the SSH port could log into accounts that do not have a password set, posing a significant security risk to the affected systems.

Affected Versions and Proposed Solution

The affected versions of Alpine Linux range from 3.16 to 3.24 and the edge branch. The vendor has released updates to fix this password authentication bypass in OpenSSH on Alpine Linux, with specific versions for each branch:

• edge — 10.6_p2-r0
• 3.24 — 10.3_p1-r2
• 3.23 — 10.2_p1-r1
• 3.22 — 10.0_p1-r11
• 3.21 — 9.9_p2-r1
• 3.20 — 9.7_p1-r6
• 3.19 — 9.6_p1-r3
• 3.18 — 9.3_p2-r4
• 3.17 — 9.1_p1-r7
• 3.16 — 9.0_p1-r6

After installing the update, the SSH service must be restarted with the command rc-service sshd restart to apply the changes.

Temporary Measures and Recommendation

If the update cannot be applied immediately, INCIBE-CERT recommends checking access via public key and disabling password authentication by setting PasswordAuthentication no in the active sshd configuration, followed by a service restart.

Importance of the Notice and Follow-Up

This password authentication bypass in OpenSSH on Alpine Linux has been rated with high severity, given the possibility of an attacker gaining access without a password to certain accounts. The notice is registered under the identifier CVE-2026-123158. INCIBE-CERT has issued this early alert to inform affected users and system administrators.

For more details and follow-up, it is recommended to consult the official notice from Alpine Linux and the information published by INCIBE-CERT on their website.

Source: INCIBE-CERT

You may also be interested in

• SQL Injection Vulnerability Detected in Frappe's ERPNext
• Una vulnerabilidad crítica de SSRF no autenticada detectada en MLflow
• Detection of Multiple Vulnerabilities in the WordPress Core Affecting Security