# Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (OpenSSH 10.6p2) · pwn.watch

> Alpine Linux warned that sshd built without PAM can be logged into without a password. On those builds sshd checks a password by running crypt() and comparing the result to the stored password field, borrowing another account's salt when the stored field has none. musl's crypt() returns "*" as an error when the password is longer than 256 bytes, and "*" is exactly what the stored field holds for accounts with no password, so the comparison matches. An attacker who can reach the SSH port and knows the name of such an account can log in with one connection by sending a 257 to 1024 byte password, as long as the machine has at least one other account with a $5$ or $6$ hash. Affected setups are Alpine's openssh-server package (or openssh-server-pam with UsePAM no) with PasswordAuthentication yes, on every release Alpine checked from 3.16 through 3.24 and edge. OpenSSH released 10.6p2 on Nov 5 2026 to avoid the bug in sshd, and Alpine shipped fixed packages for 3.16 to 3.24 and edge. No CVE had been assigned when the advisory was published.

Page: https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026 · generated 2026-11-05T15:16:48.522Z

## Status
- Severity: critical · status: live · patch: patched
- Product: OpenSSH sshd on Alpine Linux (openssh-server, built without PAM)
- Started: 2026-11-05
- Affected: Alpine Linux 3.16 through 3.24 and edge: openssh-server (no PAM), or openssh-server-pam with UsePAM no, with PasswordAuthentication yes; Official Alpine tiny-cloud images 3.18.11 through 3.24.3 (alpine user with * password and passwordless doas) once any $6$ hash exists on the machine
- Fixed in: OpenSSH portable 10.6p2; Alpine edge openssh 10.6_p2-r0; Alpine 3.24 openssh 10.3_p1-r2 (3.24.4); Alpine 3.23 openssh 10.2_p1-r1 (3.23.8); Alpine 3.22 openssh 10.0_p1-r11 (3.22.8); Alpine 3.21 openssh 9.9_p2-r1 (3.21.10); Alpine 3.20 openssh 9.7_p1-r6; Alpine 3.19 openssh 9.6_p1-r3; Alpine 3.18 openssh 9.3_p2-r4; Alpine 3.17 openssh 9.1_p1-r7; Alpine 3.16 openssh 9.0_p1-r6

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026.json
- This file: https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-05: OpenSSH releases portable 10.6p2 with a fix that avoids a password authentication bypass in sshd affecting some Linux systems built and run without PAM, reported by Özgün Kültekin of Wakefield. (https://www.openssh.org/releasenotes.html)
- 2026-11-05: Alpine Linux publishes its advisory and fixed openssh packages for 3.16 through 3.24 and edge, and says to restart sshd after upgrading or set PasswordAuthentication no. (https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/)

## Fix brief
# Security brief: Alpine Linux sshd password authentication bypass lets anyone log in to key-only accounts (OpenSSH 10.6p2)

Source: https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026 · status: live · severity: critical · updated Nov 5, 2026, 15:01 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Alpine Linux warned that sshd built without PAM can be logged into without a password. On those builds sshd checks a password by running crypt() and comparing the result to the stored password field, borrowing another account's salt when the stored field has none. musl's crypt() returns "*" as an error when the password is longer than 256 bytes, and "*" is exactly what the stored field holds for accounts with no password, so the comparison matches. An attacker who can reach the SSH port and knows the name of such an account can log in with one connection by sending a 257 to 1024 byte password, as long as the machine has at least one other account with a $5$ or $6$ hash. Affected setups are Alpine's openssh-server package (or openssh-server-pam with UsePAM no) with PasswordAuthentication yes, on every release Alpine checked from 3.16 through 3.24 and edge. OpenSSH released 10.6p2 on Nov 5 2026 to avoid the bug in sshd, and Alpine shipped fixed packages for 3.16 to 3.24 and edge. No CVE had been assigned when the advisory was published.

Severity detail: Unauthenticated login over SSH in one attempt to any account whose password field is "*", on non-PAM builds with PasswordAuthentication yes and at least one $5$/$6$ hash on the host; no CVE assigned yet; no exploitation reported

- Product: OpenSSH sshd on Alpine Linux (openssh-server, built without PAM)

## Affected versions
- Alpine Linux 3.16 through 3.24 and edge: openssh-server (no PAM), or openssh-server-pam with UsePAM no, with PasswordAuthentication yes
- Official Alpine tiny-cloud images 3.18.11 through 3.24.3 (alpine user with * password and passwordless doas) once any $6$ hash exists on the machine

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- OpenSSH portable 10.6p2
- Alpine edge openssh 10.6_p2-r0
- Alpine 3.24 openssh 10.3_p1-r2 (3.24.4)
- Alpine 3.23 openssh 10.2_p1-r1 (3.23.8)
- Alpine 3.22 openssh 10.0_p1-r11 (3.22.8)
- Alpine 3.21 openssh 9.9_p2-r1 (3.21.10)
- Alpine 3.20 openssh 9.7_p1-r6
- Alpine 3.19 openssh 9.6_p1-r3
- Alpine 3.18 openssh 9.3_p2-r4
- Alpine 3.17 openssh 9.1_p1-r7
- Alpine 3.16 openssh 9.0_p1-r6

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
If you run sshd on Alpine Linux, run apk upgrade -U -a and then restart sshd (rc-service sshd restart), because upgrading the package does not replace the running daemon. If you can't update yet, set PasswordAuthentication no and restart sshd. Check /var/log/messages for 'Accepted password for' lines on accounts that have no password (alpine, root or key-only users), and review doas use, new users and authorized_keys on exposed machines.

## Latest updates
- Nov 5, 2026: OpenSSH releases portable 10.6p2 with a fix that avoids a password authentication bypass in sshd affecting some Linux systems built and run without PAM, reported by Özgün Kültekin of Wakefield.
- Nov 5, 2026: Alpine Linux publishes its advisory and fixed openssh packages for 3.16 through 3.24 and edge, and says to restart sshd after upgrading or set PasswordAuthentication no.

## Advisories
- [Security advisory: openssh-server password authentication bypass](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) (Alpine Linux)
- [OpenSSH 10.6p2 release notes](https://www.openssh.org/releasenotes.html) (OpenSSH)

## Caveats
Watch for a CVE assignment and for other musl-based distributions that ship sshd without PAM.

---
Machine-readable: https://pwn.watch/i/alpine-openssh-musl-crypt-password-auth-bypass-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.