Password authentication was left enabled on an Alpine box I hadn't touched in eleven months. That flag was supposed to be inert. The account had no password hash — key-only since provisioning. According to the advisory now circulating, that inert flag is the entire attack surface.
Four facts made it out into the world: OpenSSH on Alpine Linux, password authentication bypass, key-only accounts exposed while password auth remains enabled, apply the workaround now. No CVE number. No affected version range. No CVSS score. No exploitation telemetry. No patch.
Twenty-three years of watching this ecosystem tells me the missing CVE is louder than anything actually printed. No identifier means no scanner hit. No scanner hit means your vulnerability dashboard reads clean while your container sits wide open. I have watched that exact failure mode play out before — November 2022, when the counterparties everyone assumed were solvent turned out to be the ones nobody had bothered to check.
Speed beats analysis when the graph is vertical. This is the inverse problem. The graph is flat. The risk is vertical.
The plumbing matters more than the headline. OpenSSH is the default SSH implementation on effectively every Linux and Unix server in existence — the penetration rate is not 90%, it is statistical noise away from 100%. Alpine is the lightweight distribution that became the default base image for containerized workloads: small, musl-linked, busybox-flavored, and dominant in precisely the deployment profile crypto runs on. Cheap VPS instances. Docker images. Validator nodes. Arbitrage bots. CI runners holding deploy keys to production wallets.
That combination — a universal protocol implementation sitting on a deliberately non-mainstream libc — is why this belongs in a crypto publication and not just an infrastructure mailing list. Node operators did not choose Alpine because they audited its PAM stack. They chose it because a Debian image is 120MB and an Alpine image is 7MB, and bandwidth and cold-start latency cost money. The security posture was a passenger, never a driver.
There is a second structural detail worth pricing. Container images are immutable. You do not patch them. You rebuild them. Every image built six months ago still carries the exact userspace it was born with, and the only remediation path is a rebuild-and-redeploy cycle that touches every service in the fleet. That is a maintenance window across your entire signing infrastructure, and most teams cannot execute it in a single night.
The mechanism, reconstructed. Password authentication in sshd is a menu, not a lock. The server advertises the methods it accepts; the account record is then supposed to cut certain options off that menu before they are ever offered. On a locked or hash-less account, the shadow lookup should return a hard denial. The defect class here is almost certainly fail-open: when the credential lookup errors out on musl — which does not implement the glibc NSS chain the PAM modules were largely written against — the failure path gets interpreted as "no password configured," and "no password configured" gets handled as "password not required" rather than "authentication denied." One branch, one wrong default, and a key-only account accepts a password it should never have acknowledged.
Fail-open on an authentication path is CVSS 9.x territory regardless of what anyone eventually scores it. The account type is supposed to be the gate. When the gate fails, the menu itself becomes the attack surface, and the menu was always public.
The telling word is not "bypass." It is "workaround." Alpine shipped a workaround, not a patch. That single word locates the root cause. If the flaw lived in OpenSSH's own authentication code, the fix would be an upstream commit and a version bump — clean, attributable, distributable. A workaround means: disable PasswordAuthentication, tighten your exposure, and we will keep digging. It is a tourniquet, and you apply a tourniquet when you have not yet found the bleed.
I don't read whitepapers; I read order books. This week the order book had nothing to say. No token moved on this advisory. No exchange published a status page update. That is not reassurance — that is latency. The market that would price an SSH bypass does not read security advisories, and the people who read security advisories do not control the treasury.
Now the exposure math, which is where this gets ugly. Alpine's share of container base images is enormous, and inheritance is silent. A team that built a signing service from a Python image two years ago may be running Alpine three layers down without a single engineer who knows it. Ask a mid-sized exchange how many of its 400 images derive from alpine:3.x, and you will get a Slack silence. The gap is not that the vulnerability is severe. The gap is that most affected operators cannot answer the question "am I affected" without a rebuild audit they have never run.
And the configuration that everyone trusted is the one the advisory names. Key-only deployments were treated as the hardened baseline — the thing you migrate to after the audit. According to the four facts available, those are the accounts at risk. The mental model broke because operators treat authentication methods as mutually exclusive when the server actually treats them as a sequence of offers. You did not disable password login for that account. You disabled it for the accounts that had passwords. That distinction was invisible until it wasn't.
Here is the angle nobody is writing. The framing will be "Alpine had a bad week." That framing is wrong in a way that matters commercially. Alpine's entire competitive moat is size, and size comes from musl plus busybox, and musl plus busybox is exactly the compatibility debt that produced this defect. The moat and the bug are the same asset. That is not a patch problem. That is a structural one, and it will recur in a different organ of the same body eighteen months from now.
The second unreported angle is that the information vacuum is itself a product. Vulnerability scanners map CVE identifiers to package versions. No identifier, no finding. Trivy, Grype, Snyk — all blind. An organization can pass its supply-chain audit and be fully exposed in the same afternoon, and the audit will document the compliance, not the exposure. Under the current reporting regimes tightening around crypto infrastructure, that distinction between "we were compliant" and "we were secure" is going to be litigated rather than debated.
The third is incentive. No exchange will publish a post saying it ran Alpine with password authentication enabled on infrastructure adjacent to hot keys. The revised disclosure clocks give everyone a reason to sit still for seventy-two hours and hope. Silence in the first week of a vulnerability like this is not evidence of absence. It is evidence of incentives.
The best news is the news that moves the price. This did not move the price. That is the story, and it should worry you more than a red candle would.
Watch three signals. A CVE assignment with a real score tells you whether anyone outside Alpine considers this systemic or local. The migration from workaround to actual patch tells you whether the root cause has been located or merely muzzled. And a change in cloud providers' default base-image recommendations tells you how the distribution layer is quietly repricing Alpine's trust — that lever moves before any advisory does.
Until then: grep your images. Do not trust the label, and do not trust the config comment that says key-only.
One last thing worth sitting with. We have spent four years building tooling to watch on-chain behavior in real time, and almost none building the equivalent for the machines those watchers run on. The layer beneath the ledger is where the next forced liquidation actually starts — not in a smart contract, in a shell.
