Alpine Linux and OpenSSH patch flaw that’s as bad as it can get

Alpine Linux, a lightweight server operating system, has been hit with a severe security flaw that allows attackers to bypass password protection and gain access to accounts. The vulnerability, classified as CVE-2026-123158, can be exploited by sending a password between 257 and 1024 bytes long to password-disabled or key-only accounts.

This issue arose only days after Alpine Linux patched another security hole in its GitLab implementation. Security experts warn that the flaw exists due to the way OpenSSH, a key component of Alpine Linux, processes long passwords. When built without Pluggable Authentication Modules (PAM), OpenSSH hashes passwords using the crypt() function from the musl library.

However, when a password exceeds 256 bytes, crypt() returns *, which matches the default password for key-only accounts, granting attackers unauthorized access. The vulnerability affects Alpine Linux versions 3.21 through 3.24, as well as older versions 3.16 to 3.20. Other musl-based distributions at risk include Adélie Linux, Void Linux, Sabotage Linux, OpenWrt, and Yocto Project-based distributions.

While most Linux distributions using glibc's crypt() are not vulnerable, Alpine Linux emphasizes that upgrading the OpenSSH package is crucial to resolving the issue. Users who cannot update should disable PasswordAuthentication in sshd and monitor system activities for any suspicious log entries.