EDITION OF NOVEMBER 6, 2026
An SSH authentication flaw affects certain Linux configurations
Ars Technica describes a vulnerability allowing login without a password on certain configurations combining OpenSSH and musl, particularly on Alpine Linux. Patches are available, but the scope of affected systems remains partly uncertain and depends on several specific conditions.
Legal disclosure: this content was produced by an artificial intelligence system. Editorial transparency
A vulnerability in certain configurations combining OpenSSH and musl may allow login without a password. Patches from Alpine and OpenSSH make checking installations a priority. However, the risk depends on several authentication settings: the presence of an SSH service is insufficient to conclude that a system is exposed.
Certain Linux configurations allow an attacker to open an SSH session without knowing a password, Ars Technica reports. The vulnerability, named *sshole by the person who discovered it, affects Alpine Linux in particular when several technical conditions are met. Alpine and OpenSSH have released updates. These patches provide an immediate response for affected administrators, although the exact scope of the problem remains to be established.
The problem arises from the interaction between OpenSSH and musl, a library Alpine uses as an alternative to libc. To be exposed in the scenario described, an OpenSSH installation using musl must run without PAM, the mechanism responsible for authentication and account access checks. The presence of Alpine or an accessible SSH service alone is therefore insufficient to establish that a machine is vulnerable.
Other prerequisites concern local accounts. In particular, the system must contain an accessible account whose password is hashed with SHA256 or SHA512. The targeted account, meanwhile, must have an asterisk in the password field of the /etc/shadow file, a configuration the article describes as common for certain accounts using certificate authentication. Checkpoint specifies that the account providing the hash must be active.
When these conditions are met, the consequences can be significant. According to Alpine maintainers quoted by Ars Technica, an attacker able to reach the SSH port can log in without knowing the password. Checkpoint says the default PermitRootLogin prohibit password setting protects direct logins to the root account in this scenario. However, an accessible account with sudo or doas permissions may subsequently allow the attacker to obtain those privileges.
The scope beyond Alpine remains uncertain. Other distributions could be affected if they use the same configuration. The person who discovered the flaw also names OpenWRT, buildroot and yocto, but the article emphasizes that some of these claims remain unconfirmed. OpenWRT uses Dropbear rather than OpenSSH by default, a crucial distinction when assessing its exposure.
Technical responsibility is also disputed between OpenSSH and musl. This disagreement does not change the practical priority: identify machines combining musl and OpenSSH, check the conditions for exposure and apply patches to affected systems. The analysis must examine each installation's actual configuration; the available information does not allow the number of machines that are effectively vulnerable to be quantified.