OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

Summary: OpenSSH released version 10.6p2 today to fix a critical flaw that lets an attacker log in with a password of 257 to 1,024 bytes to any passwordless account on Alpine Linux servers running the standard openssh-server package, which is built without PAM. The bug traces to musl's crypt() returning * for passwords over 256 bytes, which matches the * stored for an account with no password, and it affects musl-based systems including OpenWrt, Buildroot and Yocto where the OpenSSH server is installed.
Key Takeaway: One account with a password is enough to expose every account without one, and the advisory says the attack succeeds on every try over a single connection - with tiny-cloud images from 3.18.11 through 3.24.3 becoming open once any $6$ hash exists, letting an attacker log in as alpine and use passwordless doas to become root.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026