---
title: OpenSSH 10.6p2 fixes a password bypass on Alpine Linux: a 257-1024 byte password logs in to accounts that have no password set | ctxsec
url: https://ctxsec.com/items/alpine-openssh-musl-password-bypass-long-password-10-6p2
description: "Alpine Linux says an attacker who can reach sshd can log in without knowing any password, in one try, on systems where sshd runs without PAM and password logins are on. The attacker needs the name of an account whose shadow password field is * (normal for key-only accounts) and the machine needs at least one other account with a $5$ or $6$ hash; sending a very long password then succeeds. OpenSSH says the root cause is outside sshd (Alpine's advisory ties it to musl's crypt()) but it is exploitable through sshd, and fixed it in Portable OpenSSH 10.6p2. Every Alpine release Alpine checked is affected, 3.16 through 3.24 and edge. Reported by \u00d6zg\u00fcn K\u00fcltekin of Wakefield."
status: "official (Alpine Linux security advisory and OpenSSH 10.6p2 release notes, Nov 5); no CVE assigned yet"
published: 2026-11-05
---

> Alpine Linux says an attacker who can reach sshd can log in without knowing any password, in one try, on systems where sshd runs without PAM and password logins are on. The attacker needs the name of an account whose shadow password field is * (normal for key-only accounts) and the machine needs at least one other account with a $5$ or $6$ hash; sending a very long password then succeeds. OpenSSH says the root cause is outside sshd (Alpine's advisory ties it to musl's crypt()) but it is exploitable through sshd, and fixed it in Portable OpenSSH 10.6p2. Every Alpine release Alpine checked is affected, 3.16 through 3.24 and edge. Reported by Özgün Kültekin of Wakefield.

[← Cybersecurity News](/news) · [markdown](/items/alpine-openssh-musl-password-bypass-long-password-10-6p2.md)

official (Alpine Linux security advisory and OpenSSH 10.6p2 release notes, Nov 5); no CVE assigned yet

2026-11-05

### OpenSSH 10.6p2 fixes a password bypass on Alpine Linux: a 257-1024 byte password logs in to accounts that have no password set

- **Affected (per Alpine):** the `openssh-server` package (built without PAM), or `openssh-server-pam` with `UsePAM no`; `PasswordAuthentication yes` (the default); an account whose password field is `*` (root ships as `root:*` since about 3.16, key-only users, directory users via musl-nscd, the `alpine` user in tiny-cloud images); and at least one local `$5$`/`$6$` password hash. Root is protected only if `PermitRootLogin` stays at `prohibit-password`, and not if another reachable account can become root (e.g. via doas).
- **Not affected:** containers that don't run sshd, `PasswordAuthentication no` (cloud-init images set this), `UsePAM yes`, accounts locked with `!`.
- **Fix:** `apk upgrade -U -a`, then **restart sshd** (`rc-service sshd restart`); the package upgrade does not restart the running daemon. Fixed openssh builds: edge 10.6_p2-r0, 3.24 10.3_p1-r2, 3.23 10.2_p1-r1, 3.22 10.0_p1-r11, 3.21 9.9_p2-r1, with fixes also for 3.16-3.20.
- **If you can't update:** set `PasswordAuthentication no` and restart sshd (test key login in a second session first).

Other musl-based distributions that build OpenSSH without PAM should check with their maintainers.

Sources: [Alpine Linux: Security advisory: openssh-server password authentication bypass (Nov 5)](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) · [OpenSSH 10.6p2 release notes (Nov 5)](https://www.openssh.org/txt/release-10.6p2)