Alpine Linux Faces Serious SSH Vulnerability: Immediate Action Required

Alpine Linux, known for its lightweight design, is currently grappling with a significant security vulnerability that poses a serious risk to users. The flaw allows attackers to easily bypass authentication through a basic exploit. System administrators are urged to take immediate action to protect their servers.

Understanding the Vulnerability

The vulnerability, classified as CVE-2026-123158, affects Alpine Linux versions ranging from 3.21 to 3.24—including earlier versions such as 3.16 to 3.20. It enables unauthorized users to gain access to accounts without passwords, simply by sending a password input of between 257 and 1024 bytes.

How the Exploit Works

According to security expert Gregory Bryant, the exploit arises from a single character error in the code. In systems where Alpine Linux runs the default OpenSSH server package without Pluggable Authentication Modules (PAM) and has PasswordAuthentication enabled, the vulnerability becomes apparent. By inputting a specific length of characters, attackers can log in to accounts set up for key-only authentication, bypassing the need for a password altogether.

Notably, Alpine is not alone in this vulnerability. Other musl-based Linux distributions, including Adélie Linux, Void Linux, and OpenWrt, also share potential exposure. Even Wind River, which manages a commercial embedded Linux operating system, is currently evaluating the situation.

Who Is at Risk?

Alpine Linux has confirmed that all releases from 3.21 to 3.24 and several earlier versions are vulnerable under specific conditions:

• The OpenSSH server is utilized without PAM support.
• PasswordAuthentication is set to yes, which is the default setting.
• At least one account has a password field set to * and another account with a hashed password of 5 or 6 characters.

While attempts to access root accounts are typically protected, administrators should be aware that other accounts that can escalate privileges to root may also pose a security risk.

Particular Vulnerability in Tiny-Cloud Images

Among the most at risk are users operating Alpine's tiny-cloud images between versions 3.18.11 and 3.24.3. These images come with an 'alpine' user configured with an empty password, making them particularly susceptible to attack as soon as any other account with a hashed password is added.

Steps to Mitigate the Threat

In response to this critical issue, Alpine Linux has swiftly rolled out patches in its recent updates: versions 3.21.10, 3.22.8, 3.23.8, and 3.24.4 are now available. To protect your systems, follow these steps:

1. Run apk upgrade -U -a to update all packages.
2. Restart the OpenSSH daemon by executing rc-service sshd restart.

Remember, simply updating the package isn’t enough—restarting the daemon is crucial to ensure the new version is effectively in service.

Monitoring for Unauthorized Access

Post-update, it’s essential for administrators to monitor their systems closely for any signs of unauthorized access. Checking logs, particularly /var/log/messages, for entries that indicate successful logins for accounts with empty passwords is recommended. If such entries are discovered, treat the system as potentially compromised and act swiftly to secure it.

This vulnerability highlights the importance of maintaining robust security practices within Linux environments. Administrators must prioritize immediate updates and remain vigilant to defend against exploitation attempts.