CVE-2026-123158 allows password authentication to be bypassed in certain Linux OpenSSH installations using musl without PAM. If you manage an Alpine VPS running SSH, check its package and configuration today. Install your branch's patched package and restart sshd.
Checked November 5, 2026. The official CVE record now identifies the issue and assigns CVSS 3.1 8.1, High severity. Alpine's initial advisory said no identifier had been assigned; publication followed later. OpenSSH describes 10.6p2 as a release containing a critical security workaround.
What happens, and why this is not automatic root access on every Alpine server
The issue involves password verification in sshd interacting with musl. When processing an excessively long password, an error result can be mistaken for an account's stored password value. The official OpenSSH change adds checks to reject that result rather than accept it as successful authentication. The affected account's password need not be known.
The viral demonstration leaves out prerequisites. Alpine identifies this combination:
sshdwithout active PAM andPasswordAuthentication yes.- A target account whose password field is
*. - Another local account with a
$5$or$6$hash.
Direct root access also depends on SSH policy. OpenSSH's default PermitRootLogin prohibit-password disables password authentication for root. Other accounts with administrative privileges still need attention. Inspect effective settings, including Match blocks, rather than assuming every account uses identical rules. OpenSSH configuration reference.
Alpine also flags older tiny-cloud images that may become exposed after local passwords are added. Containers without sshd do not expose this route. Advisory scope.
Fixed versions: not every branch needs OpenSSH 10.6p2
OpenSSH Portable 10.6p2 includes the upstream workaround. Alpine backported it into earlier package series. Compare your branch's full package version, including its -r revision:
| Alpine branch | First fixed openssh package |
|---|---|
| edge | 10.6_p2-r0 |
| 3.24 | 10.3_p1-r2 |
| 3.23 | 10.2_p1-r1 |
| 3.22 | 10.0_p1-r11 |
| 3.21 | 9.9_p2-r1 |
| 3.20 | 9.7_p1-r6 |
| 3.19 | 9.6_p1-r3 |
| 3.18 | 9.3_p2-r4 |
| 3.17 | 9.1_p1-r7 |
| 3.16 | 9.0_p1-r6 |
Package data from Alpine's official advisory. New 3.21.10, 3.22.8, 3.23.8 and 3.24.4 images include the update. A newly released image does not update an existing running instance. Exceptional patches for older branches are not a replacement for moving to a supported branch.
How to patch an Alpine VPS without losing SSH access
1. Prepare a recovery path
Keep the current session open, verify that another session can authenticate with your SSH key, and confirm access to your provider's console. Save your SSH configuration and recoverable data backups. Plan a maintenance window, especially when updating other packages too.
These commands assume an administrative root session on Alpine with OpenRC. Adapt them if the service uses a different binary, supervisor or configuration file. Do not run them against someone else's server.
2. Check the branch, package and effective configuration
cat /etc/alpine-release
apk info -v | grep '^openssh'
/usr/sbin/sshd -T | grep -E '^(passwordauthentication|permitrootlogin|usepam) '
sshd -T reports the server's calculated configuration. ssh -V identifies the client and is not sufficient to verify the service. A missing usepam line does not establish protection. For Match rules, also evaluate relevant contexts using -T -C with the actual user and connection values. sshd diagnostic options.
Do not post /etc/shadow, keys or complete configuration files in tickets or forums. Record the branch, installed revision, authentication method and responsible administrator instead.
3. Update from your branch's repositories
apk update
apk policy openssh-server
apk upgrade
Run your project on a TERAMONT VPS
Choose Linux, root access and NVMe storage for your application. Daily backups include 14-day retention; keep SSH and your OS updated.
Explore VPS plansapk update refreshes the index; apk upgrade updates installed packages, not just SSH. Review the package sources and transaction scope beforehand. Do not mix edge with a stable branch merely to obtain a larger version number. APK documentation.
Afterward, confirm that the server package reaches your branch's fixed revision. If a held package or stale repository prevents that, apply the mitigation below and resolve the update channel before closing the issue. The security advisory proposes apk upgrade -U -a; -a can replace locally installed packages with repository versions, so review its impact.
4. Validate and restart the SSH server
/usr/sbin/sshd -t && rc-service sshd restart
rc-service sshd status
apk info -v | grep '^openssh'
Installing the package does not replace an already running daemon. Alpine explicitly requires a restart. Official update instructions.
If validation fails, fix the configuration before proceeding. Open a new connection, confirm the intended authentication method, and only then close your maintenance session. A started state establishes that the service is running, not which package revision it uses; keep the package verification too.
Temporary mitigation: disable password authentication
If you cannot install the patch yet, make this directive effective:
PasswordAuthentication no
Test key-based access first. Review Include and Match: adding a line at the end does not guarantee that it wins. OpenSSH normally uses the first obtained value for each setting. sshd_config rules.
Validate with sshd -t, restart, then confirm passwordauthentication no with sshd -T, including contexts with specific rules. Do not enable PAM blindly as a repair: it requires suitable packages and configuration.
Containers and post-update checks
If an image does run an SSH server, update its build and replace running containers. Restarting an old image does not fetch new packages. Check templates, CI images and replicas so the next deployment does not restore the old version. Docker's image rebuilding guidance.
Investigate unexpected password logins to accounts intended for key-only access. Preserve logs and inspect users and authorized keys when there are signs of intrusion. Patching does not undo previous access; handle suspected compromise through incident response as well. This guide does not certify that a particular server is clean.
A VPS with control over infrastructure maintenance
TERAMONT VPS Hosting offers Linux options, root access, NVMe storage and daily backups with 14-day retention. These can help you prepare for and recover from changes, provided you verify restoration and application compatibility.
Choose resources for your workload and establish who maintains the OS, SSH and applications. Network DDoS protection does not fix this authentication issue: package and configuration checks remain necessary.
