- A speaker on Low Level described a code flaw in OpenSSH and musl, and said Alpine's Docker image configuration makes it reachable, given a few more conditions.
- Our reading: teams that build on a base image inherit its configuration and carry the work of rebuilding and redeploying, though the episode did not frame it that way.
A speaker on the Low Level show described an SSH login flaw whose reach depended on how Alpine Linux's Docker image is configured. SSH is the standard tool for logging in to servers remotely. The flaw sits in code. The speaker said the image's defaults make it reachable, once a few other conditions hold.
What was said
The episode, "SSH situation is insane," was published on 6 November 2026. The speaker presented research by someone else. He read a news headline: typing a password longer than 256 characters could let anyone into Alpine Linux and some other distributions. The headline added that emergency fixes were issued for OpenSSH and musl libc, a core system library.
The speaker said Alpine's Docker image has password login on and does not use PAM, a plug-in system for checking logins. He called it "vulnerable by default." Two accounts must also exist. One is locked, with a star stored in place of a password hash. The other has a real password hashed with SHA-512. An attacker then sends a very long string of the letter A and lands in a shell. He said Alpine's main user acts much like root, the all-powerful account.
He stressed that this is not a buffer overflow. A locked account stores a star instead of a hash. The hashing routine fails on a very long password, and its failure value is also a star. The two stars match, so the login succeeds. The speaker said pieces of code had drifted apart in what each assumed about the others. In his words, "that failure will cascade into a star that is then the hash for the other users."
Why it matters
Our reading: the flaw was in OpenSSH and musl code, but the image's configuration helped decide whether a given Alpine-based container could be reached. A team that starts from the image inherits those settings without choosing them.
The fix itself came from upstream. The work of finding which images use the base, rebuilding them and redeploying would fall on the downstream teams. For anyone who builds or buys software, the practical question is plain. What login settings does our base image turn on before we write a line? Someone should own that answer.
The other side
The flaw is narrow. The speaker said Debian, Ubuntu, Fedora and anything using PAM, Dropbear or OpenBSD are fine. He also said password login is on by default in SSH generally, so that setting is not unique to Alpine. He conceded the affected configurations are "not a lot," though probably a large part of the internet.
The episode does not say that anyone was attacked. It does not argue that base-image maintainers owe their users safer defaults. That framing is ours.
The speaker relayed the maintainers' side only briefly: word lists have not held 300-letter passwords. The episode does not settle whether that was reasonable. Nor does it say who should have caught the fault sooner.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- Low Level: SSH situation is insane (2026-11-06)
