Critical OpenSSH Flaw Hits Alpine and Other musl Linux Distros
CVE-2026-123158 lets attackers log into password-disabled accounts by sending oversized passwords; Alpine says releases 3.16 to 3.24 and edge are affected.
A critical authentication bypass in OpenSSH affects Linux distributions built on the musl C library, tracked as CVE-2026-123158, and has been disclosed along with patches. The flaw lets an attacker log into accounts that have passwords disabled or are configured for key-only access by sending an oversized password of between 257 and 1024 bytes.
The bug stems from musl's crypt() function returning the string * as an error indicator for long inputs, which matches the * stored in the password field of accounts without a password. Exploiting it requires openssh-server built without PAM (or with UsePAM no) and PasswordAuthentication enabled, plus at least one other account on the machine holding a 5 or 6 password hash.
Alpine Linux said all releases it checked are affected, from 3.16 through 3.24 and edge, with tiny-cloud images 3.18.11 through 3.24.3 singled out as especially vulnerable. The distribution said containers without sshd, systems with password authentication disabled, and systems using openssh-server-pam with UsePAM yes are not affected.
Wind River said it is actively reviewing the reported vulnerability and will take appropriate action. Users are advised to patch immediately and restart the patched software.
Older context
The group that uncovered the problem said the musl crypt() behaviour behind the flaw has been present since 2016. Since about Alpine 3.16, root has shipped as root:* in the base image, but OpenSSH's default PermitRootLogin prohibit-password setting blocks direct root login.
Quick answers
What is CVE-2026-123158?
It is a critical OpenSSH authentication bypass on musl-based Linux distributions that allows login to password-disabled or key-only accounts by sending an oversized password of 257 to 1024 bytes.
Which Alpine Linux releases are affected?
Alpine said all releases it checked are affected, 3.16 through 3.24 and edge, with tiny-cloud images 3.18.11 through 3.24.3 especially vulnerable.
How do I protect my system?
Users are advised to patch immediately and restart the patched software. Containers without sshd, systems with password authentication disabled, and systems using openssh-server-pam with UsePAM yes are not affected.