MicrosoftAnalysisGitHub Advisories reports OpenSSH auth bypass on musl libc
What happened.The GitHub Advisory Database and OpenSSH maintainers published a critical advisory detailing an authentication bypass flaw affecting OpenSSH deployments running on the musl C library.
Why it matters.Lightweight container base images like Alpine Linux run across thousands of microservices and pipelines. When library error codes match lockout tokens, locked accounts permit remote password logins. Platform engineers running Alpine containers must update OpenSSH packages and restart the SSH daemon immediately. Security teams should enforce key authentication across bastions to neutralize password handling flaws.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-123158, the defect occurs when OpenSSH invokes the musl crypt function for accounts without usable password hashes.
- Password parsing defect: When submitted passwords exceed 256 bytes, musl returns an asterisk error value that matches the asterisk lockout placeholder in shadow files.
- Affected distributions: The weakness impacts Linux distributions utilizing musl libc without PAM enabled, notably standard Alpine Linux container and server images.
- Remediation release: Maintainers published OpenSSH Portable 10.6p2 and backported distribution packages, advising teams without immediate patch access to disable password authentication.