musl
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by CSO OnlineCritical OpenSSH flaw lets attackers log into password-disabled accounts on musl-based Linux
- Vulnerability reported by Ars Technica (Security)Decade-old flaw lets attackers SSH into some Alpine Linux devices without a password
Recent news
Critical OpenSSH flaw lets attackers log into password-disabled accounts on musl-based Linux
OpenSSH servers on Linux systems using the musl C library are vulnerable to a critical authentication bypass, tracked as CVE-2026-123158. A password of 257 to 1,024 characters makes the login check return a value that matches accounts with disabled passwords, so the login succeeds. OpenSSH 10.6p2 and emergency Alpine openssh updates mitigate the issue, and the affected configurations are most likely to be found on Alpine.
Decade-old flaw lets attackers SSH into some Alpine Linux devices without a password
A decade-old vulnerability in the interaction between OpenSSH and the musl C library can allow passwordless SSH logins on some Alpine Linux systems, and possibly other distributions. Exploitation requires OpenSSH built against musl without PAM, at least one account with a SHA256 or SHA512 password hash, and a target account with "" in the password field of /etc/shadow.