Alpine Linux OpenSSH auth bypass advisory
The gist
Alpine Linux issued an urgent advisory for an OpenSSH authentication bypass in its openssh-server package.
Any reachable SSH port on affected musl-based systems could be entered with one connection.
How it unfolded
- 2012 -08musl changed crypt() to return "*" on failure and added a 256-byte key limit for SHA-512 hashes.
- 2022Alpine 3.16 changed root's password field from "!" to "*", so root now matched the failure string.
- Nov 5, 2026Alpine Linux published an urgent security advisory for an authentication bypass in its openssh-server package, nicknamed sshole by researcher Özgün Kültekin of Wakefield, who reported it.
Key terms
- OpenSSH
- A suite of secure networking utilities based on the SSH protocol that provides encrypted communication over insecure networks.
- musl libc
- A lightweight C standard library for Linux-based systems, released under the MIT license and aimed at embedded and mobile devices.
Source: Wikipedia