OpenSSH fixes a musl error that could become a successful login

An account intended for SSH keys could instead accept a long, incorrect password. OpenSSH 10.6p2, released on November 5, 2026, addresses an authentication bypass affecting a particular combination of Linux components and settings. The failure was not password cracking. An error result was being mistaken for a successful comparison.

SSH provides a remote entrance to a server. Key-based access is closer to presenting a specially issued electronic key than remembering a password. But an account having no usable password does not necessarily mean the server has stopped accepting password attempts. That distinction left room for the faulty comparison to run.

Wakefield researcher Özgün Kültekin investigated the boundary between OpenSSH and its underlying libraries. The company says its team ran roughly 17,600 unusual login attempts against different builds. One combination accepted requests the others rejected. The finding illustrates how checking components in isolation can miss a dangerous interaction between them.

The relevant musl function returned an asterisk when an oversized password made its calculation fail. A password hash is a calculated fingerprint used for comparison, rather than the original password. Some accounts without a password also had an asterisk in the stored field. Treating those two matching symbols as valid credentials turned an error into permission. Imagine a receptionist matching an identity card marked “unreadable” to a guest-list entry with the same word and letting the visitor through.

Alpine's advisory describes a limited set of affected configurations: musl, password authentication enabled, no PAM authentication layer, and particular stored-password settings. Running Alpine alone is not enough. Containers with no SSH server and systems that have disabled password authentication are outside this route. Nor does the default root-login policy automatically permit direct administrator access.

The practical reason to revisit the incident after the patch is the gap between installing corrected software and running it. Alpine warns that replacing a package does not replace the SSH process already in memory. Administrators must restart the service after updating. Its interim recommendation is to disable password authentication, first ensuring that key-based access works so that legitimate administrators do not lock themselves out.

For people operating websites or rented servers, a stronger password is not the central answer here. The system must distinguish a failed calculation from a valid credential. The meaningful check is the combination actually running on a machine, not the reassuring label “key-only.”

Original advisories published: November 5, 2026.