Some configurations of Alpine Linux, and potentially devices running other distributions, are affected by a decade-old vulnerability that can allow an attacker to log in without a password. The flaw arises from the way OpenSSH interacts with musl, a lightweight alternative to the standard libc library, when OpenSSH is compiled without support for PAM, the Pluggable Authentication Module framework used for authentication and account-access checks.
Alpine is a lightweight and widely used Linux distribution, but other platforms could also be vulnerable if they use the same configuration.
A single connection can bypass authentication
Successful exploitation requires several additional conditions. The system must have at least one user account whose password is hashed with SHA-256 or SHA-512. The target account must then be configured without a password by placing an asterisk (*) in its /etc/shadow entry, the Linux file that stores password hashes.
Passwordless accounts are commonly used with certificate-based authentication, making this configuration relevant to certain types of accounts.
“An attacker with access to the SSH port can log in without knowing the password,” Alpine administrators said on November 5, 2026. “Connect once and it works every time, no need to retry.”
When logging into an account configured without a password, an attacker can reportedly gain access by entering more than 256 characters in the password field.
Why the password hash matters
Security company Check Point said that using SHA-256 or SHA-512 is “important because sshd borrows that account’s salt; without it, the attack will fail.” Its researchers also found during testing that the account must be active, rather than merely containing a password hash.
Check Point further reported that the default PermitRootLogin setting, which disallows password-based root logins, keeps the root account protected. However, an attacker who accesses any account with doas or sudo privileges could potentially use those privileges to become root.
Source: arstechnica.com