Alpine Linux has fixed an SSH authentication bypass exposing some key-only accounts. Administrators must update OpenSSH and restart the service, according to its November 5 advisory.
The published CVE record now identifies the issue as CVE-2026-123158, with a CVSS 3.1 score of 8.1. It describes affected Linux configurations using musl libc without PAM and OpenSSH versions before 10.6p2. Alpine’s advisory predates that assignment and still says no CVE had been assigned when it was written.
Which configurations are exposed?
Alpine says exploitation requires password authentication to be enabled, a target account with * in its password field, and another local account with a $5$ or $6$ password hash. Its non-PAM SSH server is affected; the PAM variant is also exposed when UsePAM no is configured. Systems using PAM, disabling password authentication, or running containers without sshd are outside those conditions.
OpenSSH 10.6p2, released November 5, includes a workaround. The developers say they consider the underlying cause to be outside sshd, although sshd can expose it. They credit Özgün Kültekin of Wakefield with the report.
The upstream patch adds a minimum-length check before accepting a stored password hash and changes password-field memory handling. That addresses a dangerous authentication outcome: a failed hashing operation must not become a successful password comparison.
Update the package, then restart
Alpine lists fixed packages including 10.3_p1-r2 for 3.24, 10.2_p1-r1 for 3.23, 10.0_p1-r11 for 3.22 and 9.9_p2-r1 for 3.21. Backports also cover older branches through 3.16. These distribution revisions matter when checking a patched installation.
After updating, restart with rc-service sshd restart. If updating must wait, disable PasswordAuthentication and restart sshd; first verify key access and keep the existing session open.
The CVE record’s CISA enrichment marks exploitation as proof of concept. That classification supports the existence of a demonstrated attack, but does not establish exploitation in the wild. Administrators should distinguish exposure from confirmed compromise when reviewing their systems.
