GoKawiilCritical OpenSSH flaw lets attackers bypass password checks on Alpine Linux
Security researchers disclosed CVE-2026-123158, a vulnerability in Alpine Linux's default OpenSSH setup that allows attackers to log into password-disabled or key-only accounts simply by sending an oversized password string. The bug stems from musl libc, the lightweight C library used by Alpine and other distros including Void Linux, OpenWrt, and Yocto-based embedded systems, meaning the exposure extends beyond Alpine itself. Alpine Linux and OpenSSH maintainers have issued patches, and users are urged to update and restart affected services immediately.