Password-disabled Linux accounts can still admit remote attackers
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Friday, November 6th, 2026.
Accounts intended to reject passwords can still admit remote attackers on certain Linux systems. The issue affects OpenSSH before 10.6p2 when musl is used without PAM and account settings rely on an asterisk to block password login. An oversized password can trigger a matching error value and be accepted. Alpine Linux and some other musl-based distributions can be exposed under those conditions.
The bypass doesn’t affect accounts with valid password hashes, and glibc-based or PAM-enabled systems aren’t affected. For leaders, the concern is that cloud images, appliances and embedded systems may contain vulnerable configurations outside standard server inventories. For defenders, the priority is to find musl-based hosts, verify their authentication settings and review logs for successful password logins to disabled accounts. The default alpine account in official Alpine AWS and Azure images may also offer a path to elevated access.
Update affected systems to OpenSSH 10.6p2, disable S S H password authentication where possible and investigate suspicious logins involving accounts that shouldn’t accept passwords.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
