Alpine Linux OpenSSH Authentication Bypass (CVE‑2026‑123158) Allows Immediate Server Takeover
What Happened — An authentication bypass in OpenSSH affects Alpine Linux and other musl‑based distributions. The flaw (CVE‑2026‑123158) is triggered when the SSH daemon runs without PAM and with PasswordAuthentication enabled. By sending a password payload between 257 and 1024 bytes, the musl crypt() function returns the literal “*”, which the daemon interprets as a successful password check. An attacker who can reach the SSH port can log in to any account—password‑disabled or key‑only—with a single connection and no retries. The vulnerability was disclosed in Alpine’s security advisory; patches are available and must be applied followed by a service restart. Other affected distros include Adélie, Void, Sabotage, OpenWrt, and Yocto‑based builds.
Why It Matters for Trust & Control Assurance — The issue highlights the need for robust authentication controls and continuous verification that credential‑validation mechanisms cannot be subverted.
Who Is Affected — Cloud‑infrastructure providers, SaaS operators, embedded‑system vendors, and any organization running musl‑based Linux servers.
Recommended Actions —
- Apply the upstream OpenSSH patch for the affected package and restart the SSH service.
- Disable
PasswordAuthenticationor enable PAM where possible. - Conduct a post‑patch audit of SSH login logs for anomalous authentication attempts.
- Update hardening baselines to include validation of cryptographic library behavior.
Technical Notes — The bypass stems from a single‑character error handling bug in musl’s crypt() implementation. No CVSS score is published yet, but the exploit requires only network access to port 22 and works reliably on every attempt. Source: ZDNet article