Alpine Linux OpenSSH Flaw Enables Passwordless Login

An OpenSSH vulnerability in Alpine Linux allows unauthenticated attackers to log in remotely without credentials. The attack exploits a flaw in sshd’s password validation when built without PAM support. An attacker sends a password between 257 and 1024 bytes long, causing the C library’s crypt() function to return an asterisk—exactly matching the password field of accounts with no password set. This single connection succeeds every time, requiring no retries or further interaction.

The vulnerability requires a specific configuration: password authentication must be enabled (the default), the system must have at least one account with an empty password field (common for key-only users or root in recent Alpine versions), and at least one other account with a hashed password. The flaw affects Alpine 3.16 through 3.24. Systems remain safe if they disable password authentication, run sshd without accounts lacking passwords, deploy containers without sshd, or use PAM-enabled OpenSSH.

Fixed packages are available for all affected versions through 3.24.4. System administrators should either upgrade openssh and restart the daemon, or immediately disable password authentication in sshd_config. Cloud image deployments face particular risk, since the default alpine user has no password but retains passwordless doas access. Once any hashed password exists on the system—such as when administrators set console passwords—attackers can gain initial access as the alpine user and escalate to root.