The Whistle: Special Bulletin - OpenSSH password bypass (CVE-2026-123158) on musl systems
OpenSSH shipped an emergency release one day after learning of the bug, with Damien Miller telling musl-libc operators to disable password auth IMMEDIATELY. CVE-2026-123158 at CVSS 8.1 lets an attacker log into any passwordless account with a single sent password, first connection, every time. glibc distributions and PAM-using systems are not affected, which is why your Ubuntu fleet is safe. Your Alpine containers with an sshd inside are another matter.
How a long password becomes a login
Alpine’s advisory walks the mechanics: sshd built without PAM checks a password by hashing the attempt with crypt() and comparing the result to the stored field. For a stored field too short to hold a salt, sshd borrows another account’s. musl’s crypt() returns the literal string * as an error indicator when the key exceeds 256 bytes, and * is also exactly what an account with no password stores in shadow. The attacker sends a 257 to 1024 byte password, star equals star, and the login succeeds. One connection works every time. OpenSSH rates the root cause as musl’s design and shipped an sshd workaround regardless.
Four conditions make a system exploitable: sshd on musl without PAM (Alpine’s default openssh-server, or openssh-server-pam with UsePAM no), PasswordAuthentication yes (the default), an account whose password field is *, and at least one $5$ or $6$ hash anywhere on the machine. Passwordless accounts are everywhere (key-only users, root in base images since roughly 3.16, directory-service users with no shadow entry), and one real password on the box is nothing. Default PermitRootLogin prohibit-password keeps root out unless you relaxed it, but a compromised lower account still reaches root through doas. Locked accounts (a ! field) stay locked both ways.
Alpine cloud images carry the worst path
The alpine user in official tiny-cloud images from 3.18.11 through 3.24.3 ships a * password field and passwordless doas, safe on first boot but exploitable the moment any $6$ hash appears, say an admin console password or a user-data hashed_passwd. From there the attacker shells in as alpine and roots the box through doas. Alpine published fixed packages in point releases 3.21.10, 3.22.8, 3.23.8 and 3.24.4 for every affected release back to 3.16, past today’s four branches.
Patch, restart, then read your logs
The upstream fix is OpenSSH 10.6p2, released the day after disclosure; on Alpine, upgrade inside the point releases above and run rc-service sshd restart, since upgrading alone does not replace the running daemon. If you cannot update yet, a PasswordAuthentication no drop-in and a restart close the hole by themselves. Test your key login before you do either.
Exploitation status: repro labs are public and a detection rule is already merged into Google’s goonami-scanner; no in-the-wild hits are confirmed as of publication. CISA’s KEV catalog does not list it yet, so the absence of a KEV alert in your feed is not a safety signal. Watch for Accepted password for lines in /var/log/messages naming an account with no password: that means compromise, then review doas use, authorized keys, and new users.
What I would tell a client: inventory musl-built sshd first, because the Alpine containers nobody remembers giving sshd to are the sneaky case; then check /etc/shadow for * accounts reachable over SSH; then patch and restart everywhere. Note the release cadence too: OpenSSH says it moved fast on purpose, after watching AI agents rediscover bugs like this within hours. And long embargoes now mostly serve whoever wants to exploit first. Something wrong here, or a stronger opinion? info@stackref.com always works.
This post was created with a Hermes AI agent (hermesagent.ai) from a weekly news gathering workflow, then reviewed and approved by Keith before publication.
