Ethical Hacking News
OpenSSH has released an emergency fix for a critical flaw that allows attackers to bypass SSH authentication on Alpine Linux servers. The vulnerability, which has been rated as critical, affects servers running the standard openssh-server package. Alpine users are advised to update their packages and restart the sshd service to fix this vulnerability.
OpenSSH has released an emergency fix for a critical flaw in Alpine Linux servers that allows attackers to bypass SSH authentication. The vulnerability can be exploited by attackers who have network access to the server, an account name, and a password between 257 and 1,024 bytes long. The flaw affects Alpine Linux servers running the standard openssh-server package, built without PAM. Other affected systems include OpenWrt, Buildroot, and Yocto, which are also built on musl. Alpine users can fix the vulnerability by updating their packages and restarting the sshd service. Turning off password logins also stops the attack, but users should ensure their SSH key login works first. The fix was released quickly after the flaw was discovered by Özgün Kültekin of Wakefield.
OpenSSH has recently released an emergency fix for a critical flaw that allows attackers to bypass SSH authentication on Alpine Linux servers. The vulnerability, which has been rated as critical, allows attackers to log in to accounts that have no password, such as SSH key-only accounts, on affected Alpine Linux servers running the standard openssh-server package. This vulnerability has been identified as a serious security issue, as it can be exploited by attackers who have network access to the server, an account name, and a password between 257 and 1,024 bytes long.
The attack works when the OpenSSH server (sshd) checks passwords without the Pluggable Authentication Module (PAM) interface, password logins are enabled, and at least one other account on the machine has a password. Alpine's openssh-server package is built without PAM, and password logins are on by default. The flaw comes from how sshd works with musl, the C library that Alpine is built on. Non-Linux systems, Linux systems built on glibc, and systems that check passwords through PAM are not affected, said Damien Miller of the OpenSSH project.
The flaw was discovered by Özgün Kültekin of Wakefield, and it affects Alpine Linux servers running the standard openssh-server package. The advisory lists four conditions that indicate a server is exposed to this vulnerability: it runs the openssh-server package, it runs openssh-server-pam with UsePAM no, passwordAuthentication is yes, and at least one other local account has a password hash starting with $5$ or $6$. The attacker also needs the name of an account with no password. This attack succeeds on every try with a single connection, according to the advisory.
On Alpine, accounts with no password set include key-only users created with adduser without a password, or with usermod -p '*'; users who come from a directory service through musl-nscd, since they have no shadow entry; root, which has shipped as root:* in the base image since about Alpine 3.16; and the alpine user in the official cloud images built with tiny-cloud. Root is protected by the default PermitRootLogin prohibit-password setting and can be reached directly only if PermitRootLogin yes is set. However, if an exposed account can become root, for example through doas, the protection does not help.
The tiny-cloud images from 3.18.11 through 3.24.3 give the alpine user passwordless doas. They are safe at first boot but become open to attack once any $6$ hash exists on the machine, for example after an admin sets a console password. Containers that do not run sshd, systems with PasswordAuthentication no, and cloud images set up through cloud-init, which writes that setting, are not affected. Accounts locked with ! in /etc/shadow are not affected either, and neither are machines where no account has a $-style password hash.
The flaw is not limited to Alpine. Özgün Kültekin of Wakefield, who reported it, names OpenWrt, Buildroot and Yocto in his technical write-up as other musl-based systems that are also affected. OpenWrt handles SSH with Dropbear by default, as its Dropbear documentation shows, and Kültekin says Dropbear is not affected. On OpenWrt, the flaw can matter only where an admin has installed the OpenSSH server.
To fix this vulnerability, Alpine users are advised to update their packages and restart the sshd service. The fix is a package update followed by a restart, because upgrading the package does not restart the running sshd. The advisory lists point releases 3.21.10, 3.22.8, 3.23.8, and 3.24.4 as already including the fixed package. Branches 3.16 to 3.21 are past their end of support but also got fixed packages. Cloud instances started from tiny-cloud images older than those point releases still need the update, or the setting below. If you build OpenSSH yourself, version 10.6p2 includes the change, as its release notes describe.
If you cannot update yet, turning off password logins also stops the attack. First, make sure your SSH key login works, and keep your current session open until a new login succeeds. Then, set PasswordAuthentication no, check the configuration with sshd -t, and restart sshd. The advisory gives commands that add the setting in a drop-in file in /etc/ssh/sshd_config.d, which Alpine's default configuration reads from 3.19 onward. They also change every PasswordAuthentication line in /etc/ssh/sshd_config from yes to no, including lines inside a Match block. Afterward, sshd -T | grep -i passwordauthentication should print passwordauthentication no.
The advisory suggests looking in /var/log/messages for sshd lines reading Accepted password for an account that has no password, such as alpine, root, or a key-only user. On exposed machines, also review doas use, recently created users, files, and authorized keys. If you cannot rule out a login, treat the machine as compromised, it says.
The vulnerability comes from how sshd works with musl, the C library that Alpine is built on. The upper end of the range is sshd's own limit of 1,024 bytes per password. The 10.6p2 code change makes sshd refuse a match when the stored field is shorter than four characters. OpenSSH calls it a workaround and says the root cause lies outside sshd. Stable Alpine packages carry a patch for the same problem.
The fix was released the next day after the flaw was discovered by Özgün Kültekin of Wakefield. The team learned of the flaw earlier this week and shipped the fix as fast as it could. In the release announcement, he said the team now sees long embargoes as dangerous and mainly helpful to attackers, because it has recently seen AI agents find the same bugs again, sometimes within hours.
Related Information:
https://www.ethicalhackingnews.com/articles/OpenSSH-Flaw-Exposes-Alpine-Linux-Servers-to-Unauthenticated-SSH-Login-Attacks-ehn.shtml
https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html
Published: Thu Nov 5 18:25:17 2026 by llama3.2 3B Q4_K_M
