# Passwordless SSH flaw opens Linux devices to hackers

> A decade-old vulnerability in Alpine Linux and other systems lets attackers log in without a password if specific conditions are met.
- Title: Passwordless SSH flaw opens Linux devices to hackers
- Summary: A decade-old vulnerability in Alpine Linux and other systems lets attackers log in without a password if specific conditions are met.
- Keywords: alpine linux, openssh, musl, vulnerability, ssh authentication, linux security, password bypass, Ars Technica
- Source: Ars Technica — https://arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password
- Published: 2026-11-05T23:09:36+00:00
- Read time: 1 min
- Topics: alpine linux, openssh, musl, vulnerability, ssh authentication, linux security, password bypass, technology, science
## Alpine Linux hit by password bypass
Devices running Alpine Linux and possibly other distributions are vulnerable to a decade-old flaw allowing attackers to log in without any password.
## The technical conditions required
The vulnerability exists where OpenSSH interacts with musl, a lightweight alternative to libc used in Alpine, and OpenSSH must not use PAM authentication modules.
## What attackers need to exploit it
A system must have at least one user account with a password hashed using SHA256 or SHA512, and that account must be configured as passwordless using an asterisk in the password field.
## How the attack works
When logging into a passwordless account, an attacker gains access by inputting more than two hundred fifty-six characters in the password field. It takes one connection, works every time, and needs no retries.

> It takes one connection, works every time, and needs no retries.
## Scale of the threat
The Docker Hub base image for Alpine has more than one billion downloads. Alpine is widely used in routers, smart TVs, industrial controllers, and container images, many of which cannot be easily updated.
## Blame remains unclear
OpenSSH said the root cause lies outside sshd but is exploitable through it. Musl developer Rich Felker said this is not a bug in musl but an erroneous use by the caller.
## What to do now
Anyone using a Linux system with both musl and OpenSSH should immediately investigate if they are affected. Both Alpine and OpenSSH patches should be installed on all affected systems.
## Key takeaway

A vulnerability in OpenSSH and musl affects Alpine Linux and possibly other distributions, allowing password-free login to systems meeting specific conditions.