# OpenSSH: password bypass on affected Alpine Linux servers

Canonical: https://www.oktsec.com/radar/openssh-musl-password-authentication-bypass
Publisher: Oktsec
Language: en
Published: 2026-11-07T12:52:55Z
Updated: 2026-11-07T12:52:55Z
Record reviewed: 2026-11-07T12:52:55Z
Latest evidence check: 2026-11-07T12:52:55Z
Disclosed: 2026-11-05

On Linux with musl and PAM disabled, affected SSH servers can allow password login to accounts with a '*' password field when password authentication is enabled and another account has a SHA-256 or SHA-512 password hash.

## Evidence and response priority

- Category: Vulnerability
- Oktsec priority: Act now
- Rationale: Prioritize reachable SSH services meeting the configuration and account conditions. The notices do not establish active attacks.
- Evidence: Attacks not established
- Verification: Vendor confirmed
- Fix status: Fix available
- Exposure requirement: Application or configuration dependent
- Vendor: OpenSSH / Alpine Linux
- Products: OpenSSH, Alpine Linux, musl

## Technical overview

Alpine describes PasswordAuthentication yes, PAM disabled, an account with password field * and another local account with a $5$ or $6$ hash. Direct root login also depends on PermitRootLogin. Containers without sshd are outside this scenario.

OpenSSH provides a workaround in 10.6p2; Alpine backports it. Updating the package does not restart sshd. No CVE was assigned in Alpine's notice. Check its advisory for older branch packages and investigate unexpected password logins to accounts whose password field is *.

## Recommended response

Install the branch fix and restart sshd. Test access before closing your existing session.

Relevant to: Administrators of SSH services using musl.

## Affected systems and fixes

### Portable OpenSSH on Linux with musl

Affected: Uncorrected builds with PAM disabled; password and account conditions apply.

Fixed release / action: 10.6p2 or distribution backport

### Alpine edge openssh

Affected: Earlier package revisions.

Fixed release / action: 10.6_p2-r0

### Alpine 3.24 openssh

Affected: Earlier package revisions.

Fixed release / action: 10.3_p1-r2

### Alpine 3.23 openssh

Affected: Earlier package revisions.

Fixed release / action: 10.2_p1-r1

### Alpine 3.22 openssh

Affected: Earlier package revisions.

Fixed release / action: 10.0_p1-r11

### Alpine 3.21 openssh

Affected: Earlier package revisions.

Fixed release / action: 9.9_p2-r1

Confirm the running version against the vendor advisory, including any distribution backports.

## Response checklist

1. **Update and restart** — Install the corrected package for the branch, restart sshd and verify a new connection.
2. **Disable password authentication if needed** — Verify key access and a recovery path first. Set PasswordAuthentication no, validate the configuration and restart sshd.

## Relevance to AI environments

Include SSH services on automation and build hosts.

## Sources

- [OpenSSH 10.6p2 release](https://www.openssh.org/releasenotes.html#10.6p2) — OpenSSH; Vendor notice; checked 2026-11-07T12:52:55Z
- [Alpine: password authentication bypass](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) — Alpine Linux; Vendor notice; checked 2026-11-07T12:52:55Z

## Editorial record

- 2026-11-07T12:52:55Z: Added vendor scope, corrections and response guidance.

## Use this advisory in Radar

Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment.

[Open advisory](https://www.oktsec.com/radar/openssh-musl-password-authentication-bypass) · [Build a response plan](https://www.oktsec.com/radar/openssh-musl-password-authentication-bypass#review-workspace)

- [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=openssh-musl-password-authentication-bypass&service=exposure_check)
- [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=openssh-musl-password-authentication-bypass&service=patch_verification)

## Scope and corrections

Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure.

[Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.