OpenSSH Password Authentication Bypass on Alpine Linux

OpenSSH Password Authentication Bypass on Alpine Linux

CVE-2026-123158 was publicly disclosed on 5 November 2026.

An attacker reaching SSH on certain musl-based Linux systems, including Alpine Linux, may log in to accounts that should not accept passwords.

Exploitation requires OpenSSH without PAM, SSH password authentication enabled, a passwordless account and another account with a stored password hash.
Ordinary glibc-based Linux installations are not affected by this issue.

Update to the applicable fixed OpenSSH or Alpine package, then restart sshd. If patching is delayed, disable SSH password authentication after confirming key-based access works.

SecPoint Penetrator helps organizations assess network exposure.

Get a FREE vulnerability scan:
https://www.secpoint.com/free-vulnerability-scan.php

Become a SecPoint partner:
https://www.secpoint.com/partner-signup.php

#SecPoint #OpenSSH #AlpineLinux #AuthenticationBypass #CyberSecurity