OpenSSH on musl Linux accepts any password over 256 chars — root risk on Alpine
DanielLockyer · x · 2026-11-05
A security advisory: sshd on musl-based Linux (Alpine, OpenWrt, buildroot, yocto) without PAM accepts any password longer than 256 characters, unlocking accounts whose password field is just "" (key-only, LDAP users, root on Alpine). On Alpine's official AWS/Azure images the default alpine user matches, and it has passwordless doas — effectively root.
Fix: update to openssh 10.6p2 and/or disable PasswordAuthentication. glibc/PAM distros like Debian, Ubuntu and Fedora are unaffected.
More from Safety
- OpenAI researcher: an AI security 'race to the top' is driving CVE disclosures — Eric_Wallace_ · 2026-11-06
- AI ethics researcher claims lab insiders coldly weigh catastrophe deaths against 'abundance' — LuizaJarovsky · 2026-11-06
- Firecracker VM escape disclosed: researchers claim root execution on the host — moyix · 2026-11-06
- Mustafa Suleyman flags 'deeply concerning' Delaware proposal for AI-run companies — mustafasuleyman · 2026-11-06
- Hugging Face open-sources safeagents, a local proxy that blocks reward-hacking tool calls — yb2698 · 2026-11-06
- Pinokio 8.3.7 ships security-first architecture after eMudhra certificate breach — cocktailpeanut · 2026-11-06