OpenSSH built against musl libc and running without PAM accepts any password between 257 and 1024 characters for accounts whose password field in /etc/shadow is exactly *. The accounts affected are those intentionally locked or configured for key-only authentication, including root on many Alpine cloud images, deploy users, and certain LDAP-mapped accounts.

The condition is present only on musl-based systems that do not use PAM for password verification. glibc systems, systems with UsePAM yes, Dropbear, and OpenBSD are unaffected. OpenSSH 10.6p2, released 5 November 2026, contains a workaround. Alpine has backported the fix across supported and several EOL branches.

sshhole: OpenSSH musl Password Bypass on Alpine and OpenWrt

Critical OpenSSH authentication bypass on musl Linux without PAM: accounts locked with * accept any password 257-1024 characters long. Fixed in 10.6p2.

Threat Landscape (threatlandscape.io)