# Alpine patches OpenSSH flaw that permits password-free logins

_Published Thursday, November 5, 2026 at 10:19 AM EST · Security, Infrastructure · Latest · Tier 1 — Major_

Alpine Linux warned that an OpenSSH authentication flaw lets remote attackers log into certain accounts without knowing a password. It published fixed packages for releases back to 3.16 and urged administrators to update and restart sshd; upgrading alone leaves the running service unchanged.

The flaw affects configurations with password authentication enabled and PAM absent or disabled. Exploitation requires an account with a '*' password field and another local account with a '$5$' or '$6$' password hash. Disabling password authentication and restarting sshd also closes the hole. Systems using PAM with UsePAM enabled are unaffected.

## Sources

- [alpinelinux.org](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/)
- [The Hacker News](https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html)

---
Canonical: https://techandbusiness.org/newswire/fuWs5e0i5NLYTwRe5oVIbO
Published: 2026-11-05T15:19:35.927Z
Story chronology: 2026-11-05T00:00:00.000Z
Retrieved: 2026-11-06T22:50:37.108Z
Publisher: Tech & Business (techandbusiness.org)