Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password…
Priority MEDIUM 51CWE-258Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Versions of the Official Alpine Linux Docker images (since v3.3) contain a NULL password for the `root` user. This vulnerability appears to be the result of a regression introduced in December of 2015. Due to the nature of this issue, systems deployed using affected versions of the Alpine Linux container which utilize Linux PAM, or some other mechanism which uses the system shadow file as an authentication database, may accept a NULL password for the `root` user.
Why it matters now
EPSS 0.06263 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Alpine Linux | Alpine Docker 3.3 Alpine Docker 3.4 Alpine Docker 3.5 Alpine Docker 3.6 Alpine Docker 3.7 Alpine Docker 3.8 Alpine Docker 3.9 Alpine Docker Edge | — | No fix listed | CNA |
- Alpine Linux Vendor— Affected Alpine Docker 3.3 Alpine Docker 3.4 Alpine Docker 3.5 Alpine Docker 3.6 Alpine Docker 3.7 Alpine Docker 3.8 Alpine Docker 3.9 Alpine Docker Edge Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gliderlabs:docker-alpine:*:*:*:*:*:*:*:* | 3.3 | Vulnerable | Gliderlabs |
| cpe:2.3:o:alpinelinux:alpine_linux:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Alpinelinux |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:a:f5:big-ip_controller:1.2.1:*:*:*:*:cloud_foundry:*:* | 1.2.1 | Vulnerable | F5 |
- cpe:2.3:a:gliderlabs:docker-alpine:*:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Gliderlabs
- cpe:2.3:o:alpinelinux:alpine_linux:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Alpinelinux
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:a:f5:big-ip_controller:1.2.1:*:*:*:*:cloud_foundry:*:* Versions 1.2.1 Vulnerable ·F5
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-5021
- 2026-10-03 Alias added: GHSA-m3hq-qcc9-75f6
References
Sources
- CVE-2019-5021 · CVE Program
- CVE-2019-5021 · NVD
- FIRST EPSS
- GHSA-m3hq-qcc9-75f6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences