OpenSSH ships emergency fix for long-password auth bypass on Alpine Linux

OpenSSH put out version 10.6p2 on 5 November 2026 to close a flaw that lets an attacker log in with a long password instead of the real credentials. The project rates it critical.

The bug bites on some Alpine Linux servers running the standard openssh-server package. An attacker needs network access to the box, an account name, and a password between 257 and 1,024 bytes long. With those, they can get into accounts that have no password at all, including SSH key-only accounts. That last part is the bit worth pausing on: a key-only account is normally the thing you do to make password guessing pointless.

Alpine has published fixed packages. TheHackerNews report doesn't say which Alpine releases are affected, how long the flaw was present, or whether anyone has used it. Nobody has published a write-up we've seen.

If you run Alpine with openssh-server, check your package version against Alpine's fixed builds and restart sshd after upgrading. Then look at auth logs for logins to key-only accounts, and for password attempts of unusual length if your logging captures them. We'd treat any successful login to an account with no password as worth explaining.

The upstream fix is out. Whether your Alpine mirror has it is a separate question.