Security · High impactFan score 24 · Tier C3 sources
Alpine Linux : openssh-server password authentication bypass
Lobsters ·
The Brief · written from 3 sources
- Alpine Linux published an advisory on 2026-11-05 about an openssh-server password authentication bypass.
- The bypass claims involve OpenSSH and musl libc and were debated on the oss-sec mailing list on 2026-11-07.
- The claims are disputed: a raw measurement log was published, and a libxcrypt edge case was noted where the failure token is "*" if the buffer is only two bytes, with unclear real-world impact.
Why it matters
If the bypass is confirmed for your setup, password logins on affected OpenSSH systems could be bypassed, so check whether your systems use OpenSSH with password authentication on musl libc.
Who’s affected
- Alpine Linux users running openssh-server
- Systems running OpenSSH with password authentication on musl libc
What to do
- Read the Alpine Linux advisory and check whether your openssh-server installation is affected
- #openssh
- #musl
- #authentication
- #alpine-linux
- #vulnerability
Timeline
Alpine Linux publishes advisory on openssh-server password authentication bypass
Bypass claims debated on oss-sec and raw measurement log published
Lobsters
Alpine Linux : openssh-server password authentication bypass
Open Source Security
Re: "sshole": password authentication bypass: OpenSSH + musl libc · +1 reply
Full coverage · 3 sources
- 5h ago ↗
Open Source Security
Re: "sshole": password authentication bypass: OpenSSH + musl libc - 5h ago ↗
Open Source Security
Re: "sshole": password authentication bypass: OpenSSH + musl libc - 9h ago ↗
Lobsters
Alpine Linux : openssh-server password authentication bypass