--- title: *sshole: OpenSSH Authentication Bypass Gives Attackers... description: A critical OpenSSH authentication bypass on musl-based Linux lets unauthenticated attackers log in over SSH password authentication as accounts that should... canonical: https://daily.dev/posts/sshole-openssh-authentication-bypass-gives-attackers-root-on-alpine-linux-4fddo68hd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: *sshole: OpenSSH Authentication Bypass Gives Attackers Root on Alpine Linux | daily.dev og:description: A critical OpenSSH authentication bypass on musl-based Linux lets unauthenticated attackers log in over SSH password authentication as accounts that should... og:url: https://daily.dev/posts/sshole-openssh-authentication-bypass-gives-attackers-root-on-alpine-linux-4fddo68hd og:image: https://api.daily.dev/og/posts/4FDdo68HD.png og:image:alt: *sshole: OpenSSH Authentication Bypass Gives Attackers Root on Alpine Linux og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # *sshole: OpenSSH Authentication Bypass Gives Attackers Root on Alpine Linux **[Orca Security Blog](https://daily.dev/sources/orca-security-blog)** · 3 min read · 0 upvotes · 0 comments ## Summary A critical OpenSSH authentication bypass on musl-based Linux lets unauthenticated attackers log in over SSH password authentication as accounts that should reject all passwords, including root. The flaw comes from musl libc's crypt() returning '*' on failure instead of NULL, which matches the '*' shadow field used by locked and key-only accounts. It triggers when sshd runs without PAM on musl, PasswordAuthentication is on, and a password between 257 and 1024 bytes is sent. Alpine releases 3.16 through 3.24 and edge are affected. Fix by upgrading to OpenSSH 10.6p2 or the listed Alpine package versions and restarting sshd, or set PasswordAuthentication no as a stopgap. No exploitation in the wild has been reported so far. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the musl libc crypt() bug let attackers bypass OpenSSH authentication on Alpine Linux? Musl libc's crypt() function returns the string '*' when it fails, instead of NULL as glibc does, and its SHA-256/SHA-512 crypt rejects passwords over 256 bytes. Locked or key-only accounts store '*' as their shadow password field. Sending a password between 257 and 1024 bytes makes crypt() fail and return '*', which matches the stored field, so sshd (when built without PAM) grants access, even for accounts like root that should never accept a password. _Teams hardening SSH access can track vulnerability disclosures like this one on daily.dev._ ### Which Alpine Linux versions are affected by the OpenSSH authentication bypass and what versions fix it? Alpine releases 3.16 through 3.24 and edge are affected when sshd runs without PAM on musl libc with password authentication enabled. Fixed openssh packages are 10.6_p2-r0 (edge), 10.3_p1-r2 (3.24), 10.2_p1-r1 (3.23), 10.0_p1-r11 (3.22), 9.9_p2-r1 (3.21), and 9.7_p1-r6 (3.20), corresponding to upstream OpenSSH 10.6p2. Restarting sshd after upgrading is required since the running daemon isn't replaced automatically. _Sysadmins patching Alpine fleets can follow security advisories like this through daily.dev._ ### How can I check if my server has already been compromised by the musl crypt() SSH authentication bypass? Search authentication logs for the string 'Accepted password for' on accounts that have no password set, such as locked or key-only accounts. Any host showing such a log line should be treated as compromised, since it indicates an attacker successfully exploited the crypt() error-handling flaw to log in as an account that should never accept password authentication. _Security teams auditing SSH logs for signs of compromise can follow incident writeups like this on daily.dev._ --- Tags: [#security](https://daily.dev/tags/security), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/sshole-openssh-authentication-bypass-gives-attackers-root-on-alpine-linux-4fddo68hd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"*sshole: OpenSSH Authentication Bypass Gives Attackers Root on Alpine Linux","url":"https://daily.dev/posts/sshole-openssh-authentication-bypass-gives-attackers-root-on-alpine-linux-4fddo68hd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sshole-openssh-authentication-bypass-gives-attackers-root-on-alpine-linux-4fddo68hd"},"datePublished":"2026-11-05T18:10:45.497Z","dateModified":"2026-11-05T21:43:06.843Z","description":"A critical OpenSSH authentication bypass on musl-based Linux lets unauthenticated attackers log in over SSH password authentication as accounts that should...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dee696b1401aabcb892f5ce7b868a7fd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/dee696b1401aabcb892f5ce7b868a7fd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Orca Security Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Orca Security Blog","logo":"https://media.daily.dev/image/upload/s--kkQFNboJ--/f_auto,q_auto/v1780213281/logos/orca-security-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/orca-security-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sshole-openssh-authentication-bypass-gives-attackers-root-on-alpine-linux-4fddo68hd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ssh","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Orca Security Blog","item":"https://daily.dev/sources/orca-security-blog"},{"@type":"ListItem","position":3,"name":"*sshole: OpenSSH Authentication Bypass Gives Attackers Root on Alpine Linux"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/sshole-openssh-authentication-bypass-gives-attackers-root-on-alpine-linux-4fddo68hd#faq","mainEntity":[{"@type":"Question","name":"How does the musl libc crypt() bug let attackers bypass OpenSSH authentication on Alpine Linux?","acceptedAnswer":{"@type":"Answer","text":"Musl libc's crypt() function returns the string '*' when it fails, instead of NULL as glibc does, and its SHA-256/SHA-512 crypt rejects passwords over 256 bytes. Locked or key-only accounts store '*' as their shadow password field. Sending a password between 257 and 1024 bytes makes crypt() fail and return '*', which matches the stored field, so sshd (when built without PAM) grants access, even for accounts like root that should never accept a password. Teams hardening SSH access can track vulnerability disclosures like this one on daily.dev."}},{"@type":"Question","name":"Which Alpine Linux versions are affected by the OpenSSH authentication bypass and what versions fix it?","acceptedAnswer":{"@type":"Answer","text":"Alpine releases 3.16 through 3.24 and edge are affected when sshd runs without PAM on musl libc with password authentication enabled. Fixed openssh packages are 10.6_p2-r0 (edge), 10.3_p1-r2 (3.24), 10.2_p1-r1 (3.23), 10.0_p1-r11 (3.22), 9.9_p2-r1 (3.21), and 9.7_p1-r6 (3.20), corresponding to upstream OpenSSH 10.6p2. Restarting sshd after upgrading is required since the running daemon isn't replaced automatically. Sysadmins patching Alpine fleets can follow security advisories like this through daily.dev."}},{"@type":"Question","name":"How can I check if my server has already been compromised by the musl crypt() SSH authentication bypass?","acceptedAnswer":{"@type":"Answer","text":"Search authentication logs for the string 'Accepted password for' on accounts that have no password set, such as locked or key-only accounts. Any host showing such a log line should be treated as compromised, since it indicates an attacker successfully exploited the crypt() error-handling flaw to log in as an account that should never accept password authentication. Security teams auditing SSH logs for signs of compromise can follow incident writeups like this on daily.dev."}}]} ```