GoKawiilCritical OpenSSH flaw lets attackers bypass password checks on Alpine Linux
Security researchers disclosed CVE-2026-123158, a vulnerability in Alpine Linux's default OpenSSH setup that allows attackers to log into password-disabled or key-only accounts simply by sending an oversized password string. The bug stems from musl libc, the lightweight C library used by Alpine and other distros including Void Linux, OpenWrt, and Yocto-based embedded systems, meaning the exposure extends beyond Alpine itself. Alpine Linux and OpenSSH maintainers have issued patches, and users are urged to update and restart affected services immediately.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw requires only network access to an SSH port, making it an especially severe risk for exposed servers, and its presence in musl libc means it could affect a wider range of lightweight and embedded Linux systems than Alpine alone. Wind River's statement that it is 'actively reviewing' the issue suggests other vendors using musl-based distributions may still be assessing their exposure, indicating the full scope of affected systems is not yet confirmed.
- CVE-2026-123158 allows SSH login bypass on Alpine Linux using oversized passwords.
- The bug originates in musl libc, potentially affecting other distros like Void Linux and OpenWrt.
- Patches are available; administrators should update and restart OpenSSH immediately.
Source: zdnet.com — Steven Vaughan-Nichols, 2026-11-07
Published there as: “Alpine Linux and OpenSSH patch flaw that’s as bad as it can get”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.