{
  "id": 18735746,
  "title": "Alpine Linux : openssh-server password authentication bypass",
  "url": "https://urgent.news/2026/11/07/alpine-linux-openssh-server-password-authentication-bypass",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T14:51:26.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://www.alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/"
  },
  "original_language": "en",
  "account": "Alpine Linux users of the sshd service are advised to update the openssh-server package immediately to prevent a password authentication bypass vulnerability. This exploit allows attackers to login without a password if the target machine has at least one account with a $5$ or $6$ password hash. The attacker needs only one connection to succeed, and it works every time, requiring no retries. To address this issue, users should disable password logins by setting PasswordAuthentication no in the sshd configuration, and then restart the daemon. Users who cannot update the package should at least disable password logins until an update can be implemented. This vulnerability affects all Alpine releases from 3.21 through 3.24, as well as older releases that no longer receive regular updates. Affected images from the official tiny-cloud series include versions from 3.18.11 through 3.24.3. To prevent future exploitation, users are advised to review doas use and recently created users, files, and authorized keys on exposed machines.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 6,
    "also_reported_by": [
      {
        "outlet": "LWN",
        "title": "Critical security vulnerability affects OpenSSH on Alpine Linux systems",
        "url": "https://urgent.news/2026/11/05/critical-security-vulnerability-affects-openssh-on-alpine-linux",
        "published": "2026-11-05T11:39:10.000Z"
      },
      {
        "outlet": "Tom's Hardware",
        "title": "Combined OpenSSH and musl-libc flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password",
        "url": "https://urgent.news/2026/11/05/combined-openssh-and-musl-libc-flaws-let-anyone-into-alpine-linux-and",
        "published": "2026-11-05T18:14:56.000Z"
      },
      {
        "outlet": "The Register Science",
        "title": "Get root on a musl Linux system by slamming it with an overly long password",
        "url": "https://urgent.news/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long",
        "published": "2026-11-05T18:29:00.000Z"
      },
      {
        "outlet": "Techmeme",
        "title": "Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)",
        "url": "https://urgent.news/2026/11/06/researcher-sshole-a-decade-old-openssh-flaw-lets-attackers-use-a",
        "published": "2026-11-06T16:30:00.000Z"
      },
      {
        "outlet": "ZDNet",
        "title": "Alpine Linux and OpenSSH patch flaw that’s as bad as it can get",
        "url": "https://urgent.news/2026/11/07/alpine-linux-and-openssh-patch-flaw-thats-as-bad-as-it-can-get",
        "published": "2026-11-07T00:00:45.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}