Security researchers disclosed CVE-2026-123158, a vulnerability in Alpine Linux's default OpenSSH setup that allows attackers to log into password-disabled or key-only accounts simply by sending an oversized password string. The bug stems from musl libc, the lightweight C library used by Alpine and other distros including Void Linux, OpenWrt, and Yocto-based embedded systems, meaning the exposure extends beyond Alpine itself. Alpine Linux and OpenSSH maintainers have issued patches, and users are urged to update and restart affected services immediately.
zdnet.com
· 2026-11-07
A vulnerability was found stemming from musl libc's crypt function returning the sentinel string "*" when a password is too long to hash, which collides with the Unix convention that "*" denotes a locked account. Because sshd hashes login attempts for locked accounts to prevent timing attacks, this collision allows an unauthenticated user to obtain a shell—potentially as root—on musl-based systems lacking PAM, such as the official Alpine AWS image.
sunshowers.io
· 2026-11-06
Researchers disclosed a vulnerability stemming from how OpenSSH interacts with musl, the lightweight C library used by Alpine Linux, when PAM authentication is not used. On systems meeting specific conditions—including passwordless accounts marked with an asterisk in /etc/shadow and at least one SHA256/SHA512-hashed account—an attacker can log in via SSH without any password, succeeding on the first attempt with no retries needed.
arstechnica.com
· 2026-11-05
Attackers tried to exploit CVE-2026-97229, a maximum-severity remote code execution flaw in GitLab's CI/CD regex compiler, against Alpine Linux's development infrastructure on October 20-21, repeatedly crashing GitLab processes. Alpine found no direct evidence code was executed or packages tampered with, but due to missing logs it could not rule out compromise, so it rebuilt its GitLab instance and reset all passwords.
bleepingcomputer.com
· 2026-11-01
Alpine Linux said an attacker tried to exploit a critical GitLab vulnerability (CVE-2026-97229, CVSS 10.0) against its gitlab.alpinelinux.org instance on October 20-21, a week after a fix was released but before the instance was patched. The attempts crashed worker processes eight times and came close to succeeding, though the team found no confirmed evidence of a successful breach. As a precaution, the instance was rebuilt from scratch, all user passwords were reset, and the service is being tested before reopening to the public.
alpinelinux.org
· 2026-10-28
A new operating system called AlpineBSD has been introduced, pairing the NetBSD kernel and core utilities with a userspace inspired by Alpine Linux's apk-tools package manager and busybox. The project explicitly aims to avoid AI-generated code in its base system and main package repository, and currently has no installer, offering only a high-level manual installation guide. It uses the s6 init system rather than Alpine's OpenRC, with OpenRC support planned as an alternative.
wiki.alpinebsd.org
· 2026-10-28
GoKawiil