[Security](https://leakly.com/security/)

[Confirmed]

# OpenSSH flaw on musl-based Linux lets attackers into password-disabled accounts

The bug affects Alpine Linux and similar distributions and has existed since 2016, its finder says.

Leaked on 05 November 2026

![Screenshot of @BleepinComputer's X post: OpenSSH flaw lets attackers log into password-disabled Linux accounts](https://leakly.com/assets/images/openssh-musl-oversized-password-flaw-hero.jpg)

@BleepinComputer's post on X, with counts as of 09 Nov 2026 12:49 UTC. [Live post on X](https://x.com/BleepinComputer/status/2118399388179390659)

A newly disclosed flaw involving OpenSSH and the musl C library lets attackers log into some password-disabled accounts on Alpine Linux and other musl-based systems by entering an oversized password, [BleepingComputer](https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/) (@BleepinComputer) reported on November 5.

> **BleepingComputer** @BleepinComputer
>
> OpenSSH flaw lets attackers log into password-disabled Linux accounts
> https://t.co/LWl0bHVprv
> https://t.co/LWl0bHVprv
>
> 123 likes · 39 reposts · counts as of 09 Nov 2026, 12:49 UTC
>
> — BleepingComputer (@BleepinComputer) [November 5, 2026](https://twitter.com/BleepinComputer/status/2118399388179390659)

not in our leaker index

Security researcher Ozgun Kultekin, who found the bug, says it has existed since 2016. It affects distributions including Alpine Linux, OpenWrt, Buildroot and Yocto under certain configurations, according to BleepingComputer.

The flaw has been publicly disclosed.

## What we know

* The flaw affects musl-based Linux systems.
* It dates to a 2016 OpenSSH patch.

## What we don't know

* Exploitation in the wild.

## What would confirm it

Already disclosed.

## Sources

* [Original X post by @BleepinComputer](https://x.com/BleepinComputer/status/2118399388179390659)
* [OpenSSH flaw lets attackers log into password-disabled Linux accounts](https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/)

[Confirmed]

## What happened later

The flaw has been publicly disclosed.

Status key: [how we label leaks](https://leakly.com/editorial-guidelines/#status) · [Corrections](https://leakly.com/corrections/) · [Contact](https://leakly.com/contact/)