Alpine Linux discloses OpenSSH auth bypass flaw, CVSS 8.1
The bug, tracked as CVE-2026-123158, affects Alpine's default OpenSSH server setup; fixes ship in OpenSSH 10.6p2.
Alpine Linux published a security advisory on November 5 disclosing an OpenSSH flaw that lets an attacker bypass authentication without a valid password, according to dailysecu.com. The vulnerability is tracked as CVE-2026-123158 and carries a CVSS 3.1 score of 8.1.
Affected systems are OpenSSH servers built against the musl C library with PAM authentication disabled — the setup used in Alpine Linux's default OpenSSH server configuration. An attacker with access to the SSH port can bypass authentication by entering an abnormally long password when certain account conditions are met.
Alpine Linux versions 3.16 through 3.24 and the edge version are affected. The flaw is fixed in OpenSSH 10.6p2, and Alpine is providing security packages for each affected version.
What administrators should do
Administrators must restart the SSH service after applying the update. As a temporary mitigation, Alpine recommends setting PasswordAuthentication no, provided alternative authentication such as public keys is already configured.
The advisory notes that accounts with password login disabled can still be targeted if another account on the same server holds a password hash in a specific format.
Quick answers
Which systems are affected by CVE-2026-123158?
OpenSSH servers using the musl C library with PAM authentication disabled, including Alpine Linux's default OpenSSH configuration. Affected Alpine versions are 3.16 through 3.24 and edge.
Which OpenSSH version fixes the flaw?
OpenSSH 10.6p2. Alpine Linux provides per-version security packages, and the SSH service must be restarted after updating.
How can administrators mitigate the flaw temporarily?
By setting PasswordAuthentication no, as long as alternative authentication such as public keys is configured.