OpenSSH 10.6p2 Fixes Password-Authentication Bypass on musl Linux
Summary
OpenSSH 10.6p2 addresses a password-authentication bypass affecting certain musl Linux systems. Under specific conditions, accounts marked with * could accept passwords 257–1,024 characters long; Alpine packages include fixes.
Key points
- The bypass affects OpenSSH on musl Linux when sshd handles passwords itself, password authentication is enabled, and the target account has * in /etc/shadow.
- The article says a password 257–1,024 characters long could authenticate as that account when another account on the system has a real password.
- Alpine AWS and Azure images may be at greater risk because their default alpine account can use doas without a password; the article says this could allow escalation to root.
- OpenSSH 10.6p2 adds a workaround; fixed packages are available for current Alpine releases, with fixes also committed to branches 3.16–3.19.
- If immediate updating is not possible, the article recommends disabling password authentication or restricting or stopping SSH, then checking logs for password logins to accounts marked with *.
- The article says systems using glibc, PAM-handled password logins, OpenBSD, and Dropbear are not affected.
Article Details
- Vulnerability Types
- Password authentication bypass
- Severity
- Critical
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Set PasswordAuthentication=no and restart sshd.
- Stop sshd or restrict SSH access to trusted addresses using a firewall or cloud security group.
CVE
People
Damien MillerOpenSSH developer who announced the emergency release and urged administrators to disable password authentication or SSH on affected systems.Natanael CopaAlpine maintainer who checked Dropbear’s source code in assessing whether it was affected.Ozgun KultekinFound the password-bypass flaw and published an explanation of its cause and affected configurations.Rich Felkermusl maintainer who commented that the root cause was not a musl vulnerability.
Vendors
Products
Alpine LinuxThe best-known example is Alpine Linux, a small distribution that is also a popular base image for Docker containers.DropbearDropbear, the small SSH server that many routers and embedded devices use instead of OpenSSH, is not affected either.muslOn Linux systems built on the musl C library, where sshd checks passwords itself instead of through PAM, accounts that should never accept a password will accept any password longer than 256 characters.OpenSSHOpenSSH released version 10.6p2 on November 5, 2026, with an emergency workaround for a critical flaw in sshd, the OpenSSH server.