Alpine Linux Security Advisory: OpenSSH-server password authentication bypass
- ID
- 43512
- Status
- summarized
- Published
- 05 Nov 2026, 10:44 PM
- Fetched
- 06 Nov 2026, 3:17 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/
- Source URL
- https://hnrss.org/best
Summary
- Score
- 6.0
- Created
- 06 Nov 2026, 3:18 AM
- Tags
- Audience
- developerssaas_founders
What happened
Alpine Linux published an advisory for an OpenSSH-server password authentication bypass: an attacker who can reach the SSH port can log in without a password by sending a 257–1024 byte password, provided the target account has a * password field and at least one account on the host has a $5$ or $6$ hash. It affects Alpine 3.16 through 3.24 and edge when openssh-server is built without PAM or openssh-server-pam uses UsePAM no, and PasswordAuthentication is yes. Fixed packages are in Alpine 3.21.10, 3.22.8, 3.23.8, and 3.24.4; upgrading alone does not replace the running daemon.
Why it matters
If you run sshd on Alpine with the default PasswordAuthentication yes, any key-only account — root:* in the base image or a user created without a password — can become a login path for an attacker, so you need to restart sshd after apk upgrade or set PasswordAuthentication no and restart. The operational trap is that apk upgrade -U -a alone leaves the old daemon running.
Discussion angle
The exploit condition is counterintuitive: one account with a $5$/$6$ hash makes every *-password account reachable. What does that mean for key-only service accounts and default root:* in your Alpine base images?