Alpine Linux published a security advisory on 5 November 2026 telling anyone who runs sshd on Alpine to update openssh now and restart sshd, because upgrading the package alone does not replace the running daemon.

Alpine says an attacker who can reach the SSH port can log in without knowing any password, in one connection, every time. The attacker needs the name of an account whose password field is * (an account with no password set, which is normal for key-only accounts) and the machine needs at least one other account with a $5$ or $6$ password hash; the attacker then sends a password of 257 to 1024 bytes. Alpine explains that when sshd is built without PAM it borrows another account's salt for accounts with no salt, and musl's crypt() returns the string * as an error indicator when the key is over 256 bytes, which matches the stored * field.

Alpine says you are affected if you run the openssh-server package (built without PAM) or openssh-server-pam with UsePAM no, PasswordAuthentication is yes (the OpenSSH default), the machine has an account whose password field is *, and at least one local account has a $5$ or $6$ hash. Root ships as root:* since about Alpine 3.16 but is protected by the default PermitRootLogin prohibit-password unless that is set to yes.

Alpine says the official tiny-cloud images from 3.18.11 through 3.24.3 ship an alpine user with a * password field and passwordless doas, and become exploitable as soon as any $6$ hash exists on the machine.

Alpine says every release it checked is affected, 3.21 through 3.24 and edge, plus 3.16 to 3.20, and that Docker containers not running sshd, systems with PasswordAuthentication no, openssh-server-pam with UsePAM yes, and cloud-init images are not affected. Fixed packages: edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, and fixed packages back to 3.16; Alpine 3.21.10, 3.22.8, 3.23.8 and 3.24.4 contain the fix.

No CVE identifier had been assigned at the time of writing, Alpine says. Alpine credits Özgün Kültekin of Wakefield with the report and the OpenSSH project's Damien Miller and Darren Tucker for the fix and the OpenSSH 10.6p2 release. (source: Alpine Linux)

Updated 6 Nov 2026 (BleepingComputer): BleepingComputer reported on 5 November that researcher Özgün Kültekin, who calls the flaw '*sshole', says it affects OpenSSH on Linux distributions that use the musl C library, including Alpine Linux, OpenWrt, Buildroot and Yocto, when PAM authentication is off and an account has * as its password hash; it reports him as saying systems using glibc, including Debian, Ubuntu and Fedora, and those using PAM are not vulnerable, that the behaviour traces to a 2016 OpenSSH change made to fix the username-enumeration flaw CVE-2016-6210, and that Alpine's official AWS and Azure cloud images have an affected default 'alpine' account with passwordless doas. (source: BleepingComputer)