Skip to content
securitytabs

LiveUpdated

OpenSSH releases emergency fix for login bypass on Alpine and other musl-based Linux

A flaw in the OpenSSH remote login server lets attackers sign in to some accounts on Alpine Linux and similar systems without a valid password. Organizations running those systems should check for the fixed version.

OpenSSH login bypass on musl-based Linux fixed
OpenSSH login bypass on musl-based Linux fixed

What's new

Newest coverage

TimelineWhat should my organization do?

What happened

OpenSSH released a fixed version on November 5, 2026 to block an authentication bypass nicknamed "sshole". OpenSSH rates the flaw critical. It lets attackers log in to accounts that have no usable password, such as accounts that only accept SSH keys. [1][2]

The trigger is an oversized password. An attacker needs network access to the server, an account name, and a password between 257 and 1,024 bytes long, according to the coverage of OpenSSH's advisory. [1][3]

Who is affected

The problem affects Linux distributions that use the musl C library without PAM (a pluggable login-authentication layer), including Alpine Linux servers running the standard openssh-server package. [1][3][2]

Fixes

Alpine has published fixed packages alongside the upstream OpenSSH release. The sources reviewed here do not describe exploitation or published workarounds, so what attackers are doing with the flaw is not yet established in this report. [1]

Timeline

  1. The flaw was disclosed under the nickname sshole. [2]

  2. Alpine published fixed packages. [1]

  3. OpenSSH released a fixed version to block the authentication bypass. [1]

Explained

The technology and terms in this story. Learn more

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If your servers or containers run Alpine Linux with OpenSSH, they may accept logins without a valid password. [1][2]

What to do

  1. Ask your hosting provider or IT provider whether any systems use Alpine Linux and have the fixed OpenSSH packages. [1]
  2. Ask whether SSH is reachable from the internet on those systems. [2]

Mid-size company

A small IT or security team

What to know

Key-only accounts on musl-based systems without PAM are the ones exposed, and the fix is available upstream and from Alpine. [1][3]

What to do

  1. Inventory Alpine and other musl-based hosts that run the OpenSSH server and install the fixed packages. [1]
  2. Check which of these hosts expose SSH to the network. [2]

Large enterprise

A security operations team

What to know

Exposure depends on the libc and PAM configuration, so base images and containers may be affected as well as servers. [3][1]

What to do

  1. Identify images and hosts using musl without PAM that ship openssh-server, and move them to the fixed OpenSSH release or Alpine's fixed packages. [1]
  2. Review SSH authentication logs for unusually long password attempts against key-only accounts. [1][3]

Sources

  1. [1]The Hacker News · Nov 5, 16:42 UTC
    OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linuxcontext
  2. [2]BleepingComputer · Nov 5, 17:45 UTC
    OpenSSH flaw lets attackers log into password-disabled Linux accountscontext
  3. [3]SecurityWeek · Nov 6, 12:07 UTC
    OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypasscontext
OpenSSH releases emergency fix for login bypass on Alpine and other musl-based Linux | SecurityTabs