OpenSSH flaw on musl-based Linux lets attackers into password-disabled accounts
The bug affects Alpine Linux and similar distributions and has existed since 2016, its finder says.
Leaked on 05 November 2026
A newly disclosed flaw involving OpenSSH and the musl C library lets attackers log into some password-disabled accounts on Alpine Linux and other musl-based systems by entering an oversized password, BleepingComputer (@BleepinComputer) reported on November 5.
Security researcher Ozgun Kultekin, who found the bug, says it has existed since 2016. It affects distributions including Alpine Linux, OpenWrt, Buildroot and Yocto under certain configurations, according to BleepingComputer.
The flaw has been publicly disclosed.