OpenSSH flaw let attackers into some Alpine Linux servers without a password; fixes are out

On most servers, a wrong password simply fails. On some Alpine Linux machines, a password that was just too long did the opposite: it let a stranger in.

On 5 November 2026 the OpenSSH project released version 10.6p2 with what it called a critical security workaround, and Alpine Linux published fixed packages the same day. Alpine says the OpenSSH vulnerability let anyone who could reach a server’s SSH port log in to certain accounts without the password, in one connection, every time. No attacks have been reported so far by any of the parties involved.

SSH is the remote door people use to run servers. Alpine, a small version of Linux, is common in cloud machines and containers. The fault sat where two pieces of software meet. Our reading is that this is why it hid for so long.

Which Alpine servers were open, and which were not

Alpine’s advisory lists four conditions, and all of them had to be true. The server used Alpine’s standard SSH server package, which is built without PAM, or the PAM version with PAM switched off. Password logins were allowed, which is OpenSSH’s default. Some account had no password of its own, marked with a star (*).

That is normal for accounts that log in only with keys, for root on Alpine since about version 3.16, for users from a company directory, and for the alpine user in Alpine’s small “tiny-cloud” images. Finally, at least one other account had a normal password.

A default setting blocks password logins for root itself. But Alpine warns that another account allowed to become root gets around that.

Every release Alpine checked was affected: 3.21 to 3.24 and edge, plus the unsupported 3.16 to 3.20. The fixed releases are 3.21.10, 3.22.8, 3.23.8 and 3.24.4, with fixed packages going back to 3.16. Alpine says machines are safe if password logins are off, if the PAM version runs with PAM on, or if they are containers that don’t run an SSH server. SecurityOnline reports that, according to the researcher, systems using the common glibc library are not affected.

An error message that looked like a match

The cause of this SSH password bypass is simple to describe. Without PAM, the server checks a password by scrambling it and comparing the result with the scrambled copy it stores. For accounts with no real password, it borrows another account’s settings so that the check looks the same. Alpine’s small musl library, given a password over its length limit, returns a single star to mean “error”. And a star is exactly what passwordless accounts store. The error looked like a match.

OpenSSH says the root cause lies outside its server but could be avoided inside it. The flaw was reported by Özgün Kültekin of Wakefield and fixed by OpenSSH’s Damien Miller and Darren Tucker. Alpine says no CVE identifier, the usual public tracking number, had been assigned when it wrote its advisory.

Closing the OpenSSH vulnerability: update, restart, check

Most readers have nothing to do on their phone or laptop. If you run an Alpine server, update its packages and then restart sshd, the SSH service: Alpine says the old version keeps running until you do. If you can’t update yet, switch off password logins and use keys.

Then check: Alpine says to look in the system log for SSH lines showing a password was accepted for an account that has no password. If you can’t rule an attack out, treat the machine as compromised.

The researcher also warns that other systems built on musl, such as OpenWrt home routers and some Docker images that run SSH, may be exposed. OpenWrt has not published an advisory that we could find. Like the Android TV boxes turned into a botnet, small devices left open to the internet are the ones to check first.

A quick, open fix, and a warning about speed

On balance, this is how open-source security should work. The fix came with a clear advisory, and Alpine patched even releases it no longer supports. The harder truth is that a simple fault sat for years inside a common setup, helped along by a default that leaves password logins on.

OpenSSH also says it now gets many AI-assisted bug reports and will release updates more often, because bugs found by tools are being found again by others, attackers included. Our reading is that the time between a fix and an attack is shrinking. As the Northflank breach of stored secrets showed, servers are where the valuable keys live. Key-only logins and quick updates are the calm, lasting answer.

Watch for a CVE number, advisories from other musl-based systems, and any report of real attacks. Until then, one small star is a good reason to switch password logins off for good.