{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/musl--10.6p2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-123158"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["OpenSSH (\u003c 10.6p2)","openssh-server","openssh-server-pam","tiny-cloud","musl (\u003c 10.6p2)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","authentication","linux"],"_cs_type":"advisory","_cs_vendors":["OpenSSH","Alpine Linux"],"content_html":"\u003cp\u003eA critical vulnerability exists in the \u003ccode\u003eopenssh-server\u003c/code\u003e package on Alpine Linux (and other musl-based systems) when configured without PAM and with \u003ccode\u003ePasswordAuthentication\u003c/code\u003e enabled. Attackers can bypass authentication for accounts without a set password (marked as \u003ccode\u003e*\u003c/code\u003e in \u003ccode\u003e/etc/shadow\u003c/code\u003e) by providing a password string between 257 and 1,024 bytes long. The flaw occurs because the musl \u003ccode\u003ecrypt()\u003c/code\u003e function returns an \u0026quot;unmatchable\u0026quot; value for inputs exceeding 256 bytes, which the OpenSSH authentication logic improperly equates to a successful match when borrowing a salt from another local account.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants unauthorized access to any account without a set password, including key-only users, system accounts like \u003ccode\u003eroot\u003c/code\u003e (if not otherwise restricted), and the default \u003ccode\u003ealpine\u003c/code\u003e user in certain cloud images. Unauthorized access may lead to privilege escalation if the compromised account has \u003ccode\u003edoas\u003c/code\u003e or \u003ccode\u003esudo\u003c/code\u003e rights. No attacks have been reported in the wild.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate \u003ccode\u003eopenssh-server\u003c/code\u003e to the latest version (e.g., 3.21.10, 3.22.8, 3.23.8, or 3.24.4) via \u003ccode\u003eapk upgrade -U -a\u003c/code\u003e and restart the SSH service.\u003c/li\u003e\n\u003cli\u003eIf patching is not immediate, disable password authentication by setting \u003ccode\u003ePasswordAuthentication no\u003c/code\u003e in \u003ccode\u003esshd_config\u003c/code\u003e or associated drop-in files, then verify with \u003ccode\u003esshd -t\u003c/code\u003e and restart the service.\u003c/li\u003e\n\u003cli\u003eAudit \u003ccode\u003e/var/log/messages\u003c/code\u003e for unexpected \u0026quot;Accepted password\u0026quot; logs for service or key-only accounts.\u003c/li\u003e\n\u003cli\u003eReview \u003ccode\u003edoas\u003c/code\u003e usage, recently created files, and \u003ccode\u003eauthorized_keys\u003c/code\u003e for signs of post-exploitation activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T22:30:10Z","date_published":"2026-11-05T20:26:24Z","id":"https://feed.craftedsignal.io/briefs/2026-11-openssh-auth-bypass/","summary":"An authentication bypass vulnerability in OpenSSH on Alpine Linux allows remote attackers to log in to passwordless accounts by providing a 257-1,024 byte password when password authentication is enabled.","title":"OpenSSH: Authentication bypass on Alpine Linux","url":"https://feed.craftedsignal.io/briefs/2026-11-openssh-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Musl (\u003c 10.6p2)","version":"https://jsonfeed.org/version/1.1"}