OpenSSH releases fix for password authentication bypass on musl-based Linux

OpenSSH Portable 10.6p2, released November 5, 2026, patches a password authentication bypass vulnerability affecting systems that use the musl C library instead of glibc. The flaw, tracked as CVE-2026-123158, allows an attacker with network access and a valid username to authenticate without the correct password under specific conditions.

Affected configurations

The vulnerability requires several preconditions to be met simultaneously:

• The system uses musl libc (common on Alpine Linux, some OpenWrt builds, and certain container images).
• OpenSSH is compiled or configured without PAM support (the default on many Alpine packages).
• PasswordAuthentication is enabled in sshd_config.
• The target account has a shadow password field containing exactly "*" (typical for locked or key-only accounts).
• At least one other account on the system has a standard password hash.

glibc-based distributions such as Debian, Ubuntu, and Fedora are not affected. Systems using PAM are also protected because the code path differs.

Root cause and exploitation

The issue stems from an interaction between OpenSSH’s password verification changes made in 2016 and musl’s implementation of the crypt() function. When a password exceeds musl’s internal limit, crypt() returns the literal string "*" instead of NULL. If the account’s stored hash is also "*", the comparison succeeds, granting access.

An attacker can exploit this by sending a single password between 257 and 1,024 bytes long. No brute-forcing or multiple attempts are needed. Public proof-of-concept code has appeared, though no widespread exploitation has been reported as of November 7.

Remediation

Administrators should upgrade to OpenSSH 10.6p2 or later and restart sshd. Alpine Linux has backported the fix to supported releases. As an immediate workaround, setting PasswordAuthentication no in sshd_config eliminates the risk but removes password login entirely.

The OpenSSH team noted that the rapid disclosure and fix were partly motivated by concerns that AI-assisted research could shorten future embargo periods. The vulnerability had existed in latent form since 2016 but only surfaced on musl configurations that are less commonly tested.

Sources

• www.openssh.com
• wakefield.co
• seclists.org

Cover photo by Markus Winkler on Pexels, used under the Pexels License.