Alpine Linux faces a severe authentication bypass vulnerability that allows attackers to gain server access through a single SSH connection, according to a security advisory published by the distribution maintainers.reported The flaw, tracked as CVE-2026-123158, works every time without requiring retries, presenting an immediate risk to exposed servers.reportedAttackers can easily break into Alpine Linux servers using a simple trick that works every time.CVE-2026-123158 exploits musl's crypt() error handling to bypass SSH authentication on non-PAM configurations.
What was released or claimed
Alpine Linux issued a security advisory stating that attackers can exploit the vulnerability if they reach the SSH port of a vulnerable server. The advisory notes that the attack succeeds with one connection and requires no retries. Security engineer Gregory Bryant explained on LinkedIn that the vulnerability stems from a single character error in the musl C library implementation.
Who it affects
The vulnerability impacts Alpine Linux users running the default openssh-server package without Pluggable Authentication Modules and with PasswordAuthentication enabled. Other musl-based distributions are potentially vulnerable, including Adélie Linux, Void Linux, Sabotage Linux, OpenWrt, an Android variant, and the Yocto Project. Wind River Linux is also reviewing the issue.
What is still unknown
It remains unclear whether Wind River Linux or other embedded distributions will confirm specific impact assessments beyond their initial review statements. The exact scope of affected versions within the Yocto Project and other musl-based systems has not been fully detailed in the available reports.reported
What to make of it
The flaw exploits how OpenSSH handles password verification when built without PAM. When a password key exceeds 256 bytes, the musl crypt() function returns an asterisk as an error indicator. This behavior allows attackers to bypass authentication for password-disabled or key-only accounts by sending a long password string.
What buyers should weigh
Organizations using Alpine Linux or other musl-based distributions must prioritize patching this vulnerability immediately due to its guaranteed success rate. Buyers should verify if their embedded systems or lightweight servers use the affected OpenSSH configuration. Vendor response times and patch availability will influence short-term risk management strategies for these platforms.
Why it matters
- The vulnerability allows guaranteed login bypass, eliminating the need for brute-force attempts or retries.
- It affects multiple lightweight and embedded Linux distributions, expanding the potential attack surface beyond standard servers.
- Wind River Linux is assessing the impact, indicating that commercial embedded systems may also require urgent attention.
- The flaw exploits a fundamental C library behavior, suggesting similar issues might exist in other musl implementations.
Topics: Alpine Linux, OpenSSH, CVE-2026-123158, musl, embedded Linux
Updated
Then / now / next
Alpine Linux recently avoided a security incident involving its GitLab implementation.
A critical SSH authentication bypass vulnerability is affecting Alpine Linux and other musl-based distributions.
Organizations must patch affected systems and restart the software to mitigate the risk.
Story timeline
- Then Alpine Linux recently avoided a security incident involving its GitLab implementation.
- 07 Nov 2026 Alpine Linux and OpenSSH patch flaw that’s as bad as it can get
- Now A critical SSH authentication bypass vulnerability is affecting Alpine Linux and other musl-based distributions.
- Next Organizations must patch affected systems and restart the software to mitigate the risk.
The strongest doubt
Counterpoint from the sources
Wind River Linux stated it is actively reviewing the vulnerability and will take appropriate action as needed, but has not confirmed specific impacts.
For readers
Policy
- Ensure patching protocols address guaranteed-success vulnerabilities immediately.
- Monitor embedded system vendors for impact assessments.
Business
- Prioritize patching Alpine Linux and musl-based servers to prevent unauthorized access.
- Verify OpenSSH configurations to determine exposure.
Developers
- Review musl library implementations for similar crypt() function behaviors.
- Test patches on systems using OpenSSH without PAM.
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Terms in this story
musl
A lightweight version of the standard C library used in some Linux distributions.
PAM
Pluggable Authentication Modules, a system for handling authentication in Unix-like systems.
OpenSSH
A suite of secure networking utilities based on the Secure Shell protocol.
crypt()
A C library function used for hashing passwords during authentication.
Questions readers ask
Which Linux distributions are affected by CVE-2026-123158?
Alpine Linux, Adélie Linux, Void Linux, Sabotage Linux, OpenWrt, an Android variant, and the Yocto Project are potentially vulnerable.
How does the authentication bypass work?
Attackers can log in by sending a password between 257 and 1024 bytes long, exploiting how musl's crypt() function handles long keys.
Is Wind River Linux affected?
Wind River is actively reviewing the vulnerability and assessing its potential impact, but has not confirmed specific effects yet.
Reading receipt
- CVE-2026-123158 allows guaranteed login bypass on Alpine Linux and other musl-based distributions.
- The flaw affects systems using OpenSSH without PAM and with password authentication enabled.
- Wind River Linux is assessing the potential impact of this vulnerability on its embedded products.
Still open: Will Wind River Linux confirm specific impacts on its commercial embedded distributions?
Still open: Are there other musl-based systems not yet identified as vulnerable?