Critical Alpine Linux Vulnerability: How Servers Can Be Compromised
A single character flaw in the musl library could allow attackers to bypass SSH authentication.
A Critical Security Flaw
Alpine Linux, one of the most popular and lightweight distributions in the Linux ecosystem, is facing a severe security issue. The vulnerability (CVE-2026-123158) allows an attacker to bypass security measures and gain access to a system via the SSH (Secure Shell) port. Experts classify this as a high-risk scenario, as the attack does not require brute-force attempts and can be successfully executed on the first try.
The issue stems from musl, the lightweight implementation of the standard C library (libc) used by Alpine Linux. Security engineers have identified that the flaw is triggered by a single character: the asterisk (*). When OpenSSH is configured without PAM (Pluggable Authentication Modules) and password authentication is enabled, the system fails during password validation. When a password longer than 256 bytes is entered, the musl crypt() function returns an asterisk, which the system may interpret as a valid login for an account that technically has no password.
Which Systems Are Vulnerable?
Although Alpine Linux has released updates, the threat extends to any system utilizing musl. The list of vulnerable distributions includes Adélie Linux, Void Linux, Sabotage Linux, OpenWrt, certain Android variants, and embedded systems built with the Yocto Project. Popular distributions using glibc, such as Ubuntu, Debian, or Fedora, are unaffected because they return a NULL value upon error, which the SSH server automatically rejects.
Alpine Linux’s official tiny-cloud images (versions 3.18.11 through 3.24.3) are considered particularly vulnerable. These images include a default user without a password, providing an ideal entry point for attackers if at least one other account with an encrypted password exists on the server.
What Administrators Should Do
The Alpine Linux team has released updated packages to resolve the issue. System administrators are advised to update their systems immediately using the command apk upgrade -U -a and then restart the SSH service with rc-service sshd restart. It is crucial to note that simply updating the package is insufficient; restarting the daemon is mandatory.
If an immediate update is not possible, a temporary workaround is to set PasswordAuthentication no in the SSH configuration, which disables password-based logins and restricts access to key-based authentication only. Additionally, it is recommended to monitor system logs (/var/log/messages) for suspicious login attempts. If you cannot confirm that your system has not been breached, it should be treated as compromised for security purposes.