Alpine Linux Patches Critical OpenSSH Vulnerability

a yellow door with a white handle on it — Xiangkun ZHU / Unsplash

Alpine Linux has patched a severe security vulnerability in OpenSSH that could allow attackers to gain full system control.

According to a security advisory from Alpine Linux, attackers who can access the SSH port of a vulnerable server can gain entry in a single connection. The project stated that the attack succeeds every time and does not require retries.

The vulnerability, identified as CVE-2026-123158, affects systems running Alpine Linux or other distributions using the musl C library. It occurs when the default openssh-server package is installed without Pluggable Authentication Modules and PasswordAuthentication is enabled. Attackers can log into accounts that are dedicated to public keys or have disabled passwords by sending a password between 257 and 1024 bytes in length.

The flaw stems from the musl crypt function, which returns an asterisk character as an error string when it receives a key exceeding 256 bytes. Because accounts without set passwords also store an asterisk in their password field, the system determines the hash values match and grants access. Alpine Linux noted that if at least one user with a password exists on the system, all accounts without passwords become accessible.

Other operating systems using musl may also be affected, including Void Linux, Adelie Linux, Sabotage Linux, OpenWrt, and the Yocto Project. Wind River is currently verifying the vulnerability and evaluating the impact on its commercial embedded Linux distributions to determine if a response is necessary.

Systems using the glibc C library, such as Ubuntu, Fedora, and Debian, are not affected because the glibc crypt function returns NULL during an error, which is correctly rejected by the SSH daemon. The group *sshole reported that this issue has been a latent side effect since 2016.