OpenSSH password‑authentication bypass affects Alpine Linux servers
OpenSSH versions prior to 10.6p2 contain a password‑authentication bypass that can be triggered on Linux systems using musl libc without PAM, a condition found on Alpine Linux servers. The flaw, catalogued as CVE‑2026‑123158, carries a CVSS base score of 8.1, classifying it as high severity. It works by accepting any password whose length is between 256 and 1024 characters, regardless of the actual credential. Mainstream distributions that rely on glibc, such as Red Hat, SUSE, Ubuntu and Debian, are not impacted.
What to do
IT and security teams operating Alpine‑based services should upgrade OpenSSH to version 10.6p2 or later immediately. If upgrading is not feasible, administrators can temporarily disable password authentication and enforce key‑based logins. Monitoring logs for unusually long password attempts may help detect attempted exploitation.
Context and impact
The vulnerability was first recorded by NVD on 5 November 2026 and a detailed bulletin was issued by HKCERT the following day, which rates the risk as medium despite the high CVSS rating. Proof‑of‑concept code is publicly available, but there are no confirmed reports of active exploitation in the wild.
Advice for users
Ordinary users of services hosted on Alpine Linux should verify that the provider has applied the OpenSSH update or is using key‑based authentication only.
Because the issue only manifests when musl libc is used without PAM, organizations that compile custom OpenSSH binaries can mitigate the risk by linking against glibc or by enabling PAM support, both of which restore proper password length checks.
Patch cycles and inventory of musl‑based deployments are essential to prevent similar bypasses in the future.
Member discussion