Run anything on Alpine Linux with SSH open to the internet? A password bypass is being exploited.

What happened

OpenSSH is the program that answers when you SSH into a server. The 10.6p2 release notes say the release “affects Linux systems that use the musl libc and PAM disabled,” and describe the fix as avoiding “a password authentication bypass that is exploitable through sshd.” The OpenSSH developers add that they “consider the root cause of this bug to be outside sshd, but it is exploitable via sshd and can be avoided there.” The report is credited to Özgün Kültekin of Wakefield.

The NVD entry is blunter about the effect: the bug comes from a misreading of whether a string is a password or a password hash, and “for some configurations of accounts, any password between 256 and 1024 characters succeeds.” NVD names Alpine Linux as the example platform. Public proof-of-concept repositories exist, and CISA added the flaw to its exploited list on November 9.

Most ordinary servers are not affected. Ubuntu, Debian, Red Hat and their relatives use glibc and PAM. The exposure is in the lightweight places: Alpine-based containers, small appliance images and VPS templates that someone chose years ago for their size.

Who is exposed

• Any host or container running sshd on Alpine Linux (or another musl build without PAM) with password authentication enabled and the port reachable.
• Not exposed: servers that allow key-based logins only. The bypass is in password authentication; if “PasswordAuthentication no” is set, there is nothing to bypass.
• Not exposed: mainstream distributions built on glibc with PAM, which is most managed hosting.
• If you do not know what your server runs, that is the finding. cat /etc/os-release answers it in one line.

What to do

1. Find out what you haveOn each server or container: cat /etc/os-release and ssh -V. Alpine with an OpenSSH older than 10.6p2 is the case to fix.
2. UpdateAlpine’s openssh package at 10.6_p2 or later, or rebuild the image on a current base. For Docker images, that means rebuilding and redeploying, not patching a running container.
3. Turn password logins offSet “PasswordAuthentication no” in sshd_config and use keys. This closes the flaw on its own and is the right setting regardless; keep it after the update.
4. Read the auth logSuccessful password logins you cannot account for since early November, particularly to root or service accounts, mean the host should be treated as entered.

This is the sort of thing our private server builds are set up to avoid: keys only, a mainstream base, and the stack watch reading the running versions every six hours. If a server of yours may have been reached, incident response is the page.

Sources

• OpenSSH 10.6p2 release notes
• OpenSSH portable: the fixing commit
• NVD: CVE-2026-123158
• CISA Known Exploited Vulnerabilities catalog