GoKawiilDecade-old flaw lets attackers SSH into Alpine Linux devices without a password
Researchers disclosed a vulnerability stemming from how OpenSSH interacts with musl, the lightweight C library used by Alpine Linux, when PAM authentication is not used. On systems meeting specific conditions—including passwordless accounts marked with an asterisk in /etc/shadow and at least one SHA256/SHA512-hashed account—an attacker can log in via SSH without any password, succeeding on the first attempt with no retries needed.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw's reliance on a specific, non-default combination of settings limits its blast radius, but Alpine's widespread use in containers and embedded systems means affected configurations could be common in certain environments. Checkpoint's findings about salt reuse and account activity requirements suggest the exploit mechanics are fairly narrow, which could help administrators quickly check exposure once patches or mitigations are issued.
- Vulnerability requires musl, OpenSSH without PAM, and passwordless accounts to be exploitable
- A single SSH connection with no retries can grant attacker access when conditions are met
- Alpine Linux and possibly other distributions using the same configuration are at risk
Source: arstechnica.com, 2026-11-05
Published there as: “Meet *sshole, the vulnerability that lets hackers SSH into Linux devices”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.