Critical security vulnerability affects OpenSSH on Alpine Linux systems

Critical security vulnerability affects OpenSSH on Alpine Linux systems2 publishers · first seen Thu, 05 Nov 2026 11:39 UTC · updated Thu, 05 Nov 2026 18:29 UTCOpenSSH has released an update to address a critical vulnerability, dubbed '*sshole', that allows attackers to log into passwordless accounts on musl-based Linux distributions by entering a password of a certain length. This flaw affects systems using musl libc without PAM, including Alpine Linux, and requires the OpenSSH server to have password authentication enabled. The vulnerability has been present since 2016 and was introduced as a workaround for a different issue. Administrators are advised to update to the latest version of OpenSSH or disable password authentication and restart the SSH service. Alpine Linux has also released patched packages for all branches back to a certain version.Content auto-generated. May contain inaccuracies.

Get root on a musl Linux system by slamming it with an overly long password (The Register, Thu, 05 Nov 2026 18:29 UTC)

Critical security vulnerability affects OpenSSH on Alpine Linux systems (LWN.net, Thu, 05 Nov 2026 11:39 UTC)