Key facts
- The flaw affects some Alpine Linux configurations and possibly other distributions using the same setup.
- Exploitation requires OpenSSH on musl without PAM, a SHA256 or SHA512 hashed password, and a passwordless account.
- Alpine maintainers said one connection works every time and needs no retries.
- Checkpoint said sshd borrows the account's salt, and without it the attack fails.
- Checkpoint said root accounts are safe under the default PermitRootLogin prohibit password setting.
Devices running some configurations of Alpine Linux, and possibly other distributions, are affected by a decade-old vulnerability that allows attackers to log into devices with no password, according to a report published November 5, 2026.
The flaw sits in the interaction between OpenSSH, the code library implementing SSH connections, and musl, a lightweight alternative to the libc library that Alpine uses. The report says OpenSSH running on musl must also not use PAM, the framework that handles user authentication and account-access checks. Alpine is a lightweight, widely used Linux distribution, and the report says other platforms may be affected if they use the same configurations.
Two further conditions are needed for exploitation. A system must have at least one user account accessible with a password hashed using the SHA256 or SHA512 functions, and that account must be configured as passwordless by a "*" in the password field of /etc/shadow, the Linux file where password hashes are stored. The report says passwordless accounts are commonly used for certificate-based authentication.
"An attacker who can reach your SSH port can log in without knowing any password," Alpine maintainers said Thursday. "It takes one connection, works every time, and needs no retries." The report says an attacker logging into a passwordless account can gain access by entering more than 256 characters in the password field.
Security firm Checkpoint said the use of the SHA256 or SHA512 functions "matters because sshd borrows that account's salt. Without it, the attack fails." Checkpoint researchers said their testing also showed the account must be active, not just hold a hash. Checkpoint further reported that root accounts are safe under the default PermitRootLogin prohibit password setting, though reachable accounts with doas or sudo rights can still become root.