Kyles Investigation is a Tennessee Licensed Private Investigator #5411.
SUBMIT A JOB

OpenSSH 10.6p2: Long Passwords Can Bypass SSH Login on Alpine Linux

When “wrong” fails, but 300 As grant root: OpenSSH 10.6p2 patches a critical authentication bypass on musl-based systems like Alpine Linux.

Nov 5, 2026 · @Mark

OpenSSH Portable 10.6p2, released November 5, 2026, works around a critical authentication bypass that affects sshd on Linux systems using the musl C library without PAM, including Alpine Linux. An attacker who can reach the SSH port and knows an account name can log in to certain accounts with no valid password, using one crafted password between 257 and 1,024 bytes long.

The bug was reported by researcher Özgün Kültekin. OpenSSH developer Damien Miller says the root cause lies outside OpenSSH, in how musl reports errors, but the project shipped a mitigation quickly. No CVE identifier had been assigned when Alpine published its advisory.

Who is exposed

A server is vulnerable only when all four of these are true:

  1. musl without PAM. sshd runs on musl libc and checks passwords itself rather than through PAM. On Alpine, that means the standard openssh-server package (built without PAM), or openssh-server-pam with UsePAM no.
  2. Password authentication is on. PasswordAuthentication is yes, which is the upstream default.
  3. A target account has * in its password field. Typical examples are key-only users and users supplied by a directory service through musl-nscd (nslcd, winbind, sssd), which have no shadow entry. Root is protected by default, because OpenSSH’s PermitRootLogin prohibit-password setting blocks password logins. Root is reachable only if PermitRootLogin yes is set.
  4. Another account has a real password hash. At least one local account must hold a $5$ or $6$ hash, which sshd borrows a salt from (see below).

Not affected: Linux systems on glibc, non-Linux systems, servers that verify passwords through PAM, and Dropbear. Many OpenWrt systems ship Dropbear by default, so they are exposed only in builds that use OpenSSH. Buildroot and Yocto images are exposed only if they combine musl with OpenSSH in the configuration above.

Why it works

Without PAM, sshd checks a login by hashing the submitted password with crypt() and comparing the result to the account’s stored password field. Three behaviors combine to break that check:

  1. musl signals errors with “*”. For $5$ and $6$ hashes, musl’s crypt() rejects any password over 256 bytes and returns the string “*” instead of NULL. musl chose this in 2012 because many programs never checked for failure.
  2. sshd borrows a salt. Since a 2016 timing-attack fix, sshd calls crypt() for accounts with no usable hash too, using a salt borrowed from another account that has a real $5$ or $6$ hash. That keeps response times uniform.
  3. The error matches the stored field. For an account whose field is “*”, the error value returned for a long password is identical to the stored value, so sshd treats the passwords as matching and logs the attacker in.

The attack succeeds on the first attempt, so it is trivial to automate.

The 10.6p2 change makes sshd refuse a match when the stored field is shorter than four characters.

What to do

Patch and restart. Alpine has shipped fixed openssh packages, with backports reported as far back as Alpine 3.16. Upgrading the package does not replace the running daemon, so restart sshd afterward:

  • Quick Remediation Commands
    • ​apk upgrade openssh
    • ​rc-service sshd restart
  • ​Fixed Package Versions (Alpine Advisory)
    • ​edge: 10.6_p2-r0
    • ​3.24: 10.3_p1-r2
    • ​3.22: 10.0_p1-r11
    • ​Note: Check the advisory for other branches. If building OpenSSH yourself, use version 10.6p2 or later.
  • ​Alternative Workaround (If You Can’t Patch Yet)
    • ​Confirm that key-based login works properly.
    • ​Keep your current SSH session open as a safeguard.
    • ​Set PasswordAuthentication no in /etc/ssh/sshd_config (or via a drop-in configuration file).
    • ​Validate the configuration:
      • ​sshd -t
    • ​Restart the SSH service:
      • ​rc-service sshd restart

Check the advisory for other branches. If you build OpenSSH yourself, use 10.6p2 or later.

If you can’t patch yet, turn off password authentication. First confirm that key-based login works, and keep your current session open. Then set PasswordAuthentication no in /etc/ssh/sshd_config (or a drop-in file your configuration includes), validate it, and restart:sshd -t rc-service sshd restart

Sources

Leave a Reply