cyber.hendryadrian.com
Vulnerability & Exploit · fieldeffect.com

OpenSSH 10.6p2 Fixes Password Authentication Bypass on Alpine Linux

· Original article ↗

Summary

OpenSSH 10.6p2 fixes CVE-2026-123158, which can allow SSH password authentication bypass on certain musl-based systems, including Alpine Linux. Exploitation requires specific account and configuration conditions; no activity was reported at disclosure.

Key points

  • OpenSSH released Portable OpenSSH 10.6p2 on November 5, 2026, to fix CVE-2026-123158, rated CVSS 8.1 High.
  • On affected systems without PAM, sshd may mistake a musl crypt() error for successful authentication when a passwordless account receives a 257–1,024-byte password.
  • Exploitation also requires password authentication to be enabled, network access to SSH, a valid username, and at least one local account using a SHA-256 or SHA-512 password hash.
  • Alpine Linux releases 3.16 through 3.24 and edge are affected; some other musl-based OpenSSH deployments may also be in scope. No exploitation activity had been reported at disclosure.
  • In the described Alpine tiny-cloud scenario, access to the passwordless alpine account could enable root access through passwordless doas.
  • Upgrade to OpenSSH 10.6p2 or the corresponding fixed Alpine package, and restart the SSH service. Disabling password authentication also removes the vulnerable path.

Article Details

Vulnerability Types
  • Password authentication bypass
Severity
High (CVSS 3.1: 8.1)
Affected Versions
  • Alpine Linux 3.16–3.24 and edge
  • Alpine tiny-cloud images 3.18.11–3.24.3, when a compatible password hash is present
Exploitation Status
not_reported
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • Disable password authentication.

MITRE ATT&CK

T1021.004 · SSHThe bypass is performed through SSH authentication to the vulnerable server.T1078.003 · Local AccountsSuccessful exploitation allows access to an existing local account configured without a password.

CVE

CVE-2016-6210Openbsd · OpensshThe flaw traces back to an OpenSSH timing fix in 2016 (CVE-2016-6210) and two musl changes in August 2012 that made crypt() return an asterisk on error and capped SHA-512 input at 256 bytes.CVE-2026-123158OpenBSD · OpenSSHOpenSSH released Portable OpenSSH 10.6p2 on November 5, 2026, to address CVE-2026-123158, a password authentication bypass with a CVSS 3.1 score of 8.1 (High) that affects Alpine Linux and other systems built on the

Products

Alpine LinuxCVE-2026-123158, a password authentication bypass with a CVSS 3.1 score of 8.1 (High) that affects Alpine Linux and other systems built on the musl C library.muslbypass with a CVSS 3.1 score of 8.1 (High) that affects Alpine Linux and other systems built on the musl C library.OpenSSHOpenSSH released Portable OpenSSH 10.6p2 on November 5, 2026, to address CVE-2026-123158, a password authentication bypass with a CVSS 3.1 score of 8.1 (High) that affects Alpine Linux and other systems built on the

Related Articles