Summary
- The vulnerability affects specific OpenSSH configurations using musl without PAM authentication.
- Password-disabled accounts can become accessible where additional account and server configuration conditions are met.
- Alpine has issued fixes across supported and older release branches, but administrators must restart SSH after upgrading.
Alpine Linux has issued emergency security updates following the discovery of an OpenSSH authentication bypass that can allow attackers to access accounts deliberately configured to reject password logins under specific conditions.
The vulnerability affects certain OpenSSH deployments using the musl C library and has prompted a corrected upstream OpenSSH release, alongside patches for multiple Alpine Linux versions.
Alpine’s advisory warns that an attacker who can reach an affected SSH service may be able to authenticate without knowing a valid password when the server and account configuration meet the vulnerable conditions.
The project has instructed administrators to install updated packages and restart the SSH daemon, noting that upgrading the software alone does not replace the already running process.
Password verification produces an unexpected result
OpenSSH provides encrypted remote administration for Linux servers and other systems. Its authentication process can support passwords, public keys, and mechanisms integrated through Pluggable Authentication Modules, or PAM.
Linux account records sometimes contain special values instead of usable password hashes. An asterisk in the password field, for example, can indicate that an account has no valid password and is intended to be accessed through another authorised mechanism.
The newly disclosed problem concerns how OpenSSH handles password verification errors when built against musl and operating without PAM.
Under the affected conditions, the C library can return an error indicator that matches the special value stored for an account without a usable password.
OpenSSH may then interpret the matching values as successful authentication, even though no valid password has been supplied.
The weakness does not affect all OpenSSH installations. Alpine identifies several necessary conditions, including enabled password authentication, an account whose password field contains an asterisk, and another local account using one of the relevant password-hash formats.
Systems using OpenSSH with PAM enabled are outside the documented affected configuration. Installations with password authentication disabled are also protected against this particular route.
Accounts locked using a different marker are not affected in the same way, and the issue does not automatically override separate restrictions governing root login.
These configuration distinctions matter because the vulnerability affects the interaction between the SSH server, its authentication settings, and the underlying library rather than a universal failure of encrypted remote access.
Cloud images and administrative privileges
Alpine Linux is widely used in lightweight servers, containers, appliances, and embedded environments. The vulnerability is particularly relevant to deployments that expose SSH for legitimate administration or maintenance.
Containers that do not run an SSH server are not affected through this attack path.
However, Alpine also identifies a more sensitive configuration involving its official tiny-cloud images, which include a predefined user account with no password and elevated administrative capabilities through doas.
Those images are not necessarily vulnerable immediately after deployment. The affected conditions can arise following subsequent account changes, including the creation of another local account with a conventional password hash.
Where those conditions exist, unauthorised access to the predefined account could allow an attacker to obtain administrative privileges through its existing configuration.
The flaw also has implications for embedded systems built from customised Linux distributions. Organisations using musl-based environments outside Alpine may need to establish whether their OpenSSH builds share the affected authentication behaviour.
At the time of publication, Alpine reported that no CVE identifier had yet been assigned. The correction is included in OpenSSH 10.6p2, while Alpine has issued backported fixes for older package branches.
New Alpine releases 3.21.10, 3.22.8, 3.23.8, and 3.24.4 include updated packages. The project has also made corrections available for several older branches, including releases that no longer receive regular support.
Those updates still require an operational step after installation. Administrators must restart the SSH service to replace the vulnerable running daemon.
Where immediate patching is not possible, Alpine recommends disabling password authentication, but cautions administrators to confirm that alternative public-key access works before changing the service configuration.
Incident investigation may also require reviewing authentication logs for successful password logins to accounts that should not accept them. Such evidence would warrant examination of subsequent activity and account changes.
The vulnerability was reported by Özgün Kültekin of Wakefield, with fixes developed by the OpenSSH and Alpine maintainers. Alpine published its emergency advisory and fixed packages on 5 November.
