OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Servers
OpenSSH flaw allows passwordless authentication bypass on Alpine Linux servers.
A critical vulnerability in OpenSSH allows remote attackers to bypass password authentication on specific Alpine Linux servers. The flaw, affecting systems using musl libc with PAM disabled, requires only one connection and knowledge of an account name. A workaround is available in Portable OpenSSH 10.6p2, with Alpine Linux releasing patched packages for affected versions.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Alpine Linux?
Get an email when a new story names Alpine Linux, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical flaw in OpenSSH allows attackers to completely bypass password authentication on Alpine Linux servers using musl libc with PAM disabled — requiring only a single connection and a valid account name. This matters because authentication is the most fundamental layer of access control; bypassing it grants attackers direct entry without needing credentials. The vulnerability highlights how platform-specific build configurations (musl libc + PAM disabled) can introduce unexpected security regressions in widely trusted software. Patches are available, making unpatched systems entirely indefensible against a trivially easy attack.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — OpenSSH password authentication bypass