// ZDNET — CYBERSECURITY
Alpine Linux and OpenSSH patch flaw that’s as bad as it can get
This dangerous Linux security hole must be patched as soon as possible.
The perfect nightmare scenario for a Linux server is when all an attacker needs to do is reach the server’s Secure Shell (SSH) port, waltz right in, and take it over. That’s what happened to Alpine Linux, the popular, lightweight Linux server. Adding insult to injury, this happened only days after Alpine Linux dodged a security hole-sized bullet to its GitLab implementation.
Also: Linux Mint 27 arrives next month, and I like it already: What to expect
How bad is it? As bad as it can get. Alpine Linux explained in its security advisory that if an attacker can reach a vulnerable server’s SSH port, they can get in “with one connection,” and the attack “works every time, and needs no retries.”
As security engineer Gregory Bryant explained in his LinkedIn post:
Most authentication bypasses come from complex logic chains, but yesterday’s Alpine Linux OpenSSH vulnerability (CVE-2026-123158) comes down to a single character: *.”
If you run Alpine Linux (or another musl-based distro) with the default openssh-server package (no Pluggable Authentication Modules (PAM)) and PasswordAuthentication enabled, an attacker can log into password-disabled, or key-only accounts simply by sending a password between 257 and 1024 bytes long.
Alpine Linux isn’t the only operating system that uses musl, a lightweight version of the standard C library (libc). Other operating systems that use musl and are potentially vulnerable include Adélie Linux; Void Linux; Sabotage Linux; OpenWrt, an Android variant, and the Yocto Project, which is used to build embedded Linux distributions.
Also: This clever banking scam keeps phishing by faking its own demise
Wind River, which produces the commercial embedded Linux distro, Wind River Linux, is also looking into the issue. A company representative told me, “Wind River takes security seriously. We are actively reviewing the reported vulnerability and assessing its potential impact. We will take appropriate action as needed.”