OpenSSH 10.6p2 fixes a password bypass on Alpine Linux servers
A flaw in how musl libc handles long passwords lets an attacker log into any no-password account over SSH, no PAM and no retries needed, on every supported Alpine release.
OpenSSH released 10.6p2 on 5 November as what its own notes call a critical security workaround, for sshd running on Linux systems built with musl libc and PAM disabled, which is how Alpine’s default openssh-server package ships.
The bug sits in musl’s crypt(), which returns a bare * for passwords between 257 and 1024 bytes. That collides with the * stored for accounts that have no password set, such as key-only users, root, or service accounts. Send a password of that length to one of those accounts and sshd logs you straight in, no retries, no brute-forcing. Alpine published its own advisory the same day confirming every supported release, 3.16 through 3.24 and edge, is affected, with patched packages for each branch. No CVE had been assigned when Alpine’s advisory went out.
Why it matters: Alpine is one of the most common bases for server and container deployments, and the exploit path needs nothing beyond a reachable SSH port and one no-password account, something that is routine on key-only setups. Upgrading the package is not enough: restart sshd afterwards, or the vulnerable binary keeps running.
The caveat: this only hits musl systems without PAM. Glibc distributions like Ubuntu and Debian, and any sshd already configured with PasswordAuthentication no, are not exploitable through this path.