# OpenSSH 10.6p2 fixes login bypass affecting Alpine Linux

_Published Saturday, November 7, 2026 at 12:06 AM EST · Security · Latest · Tier 2 — Notable_

![Beautiful first light from sunrise on Mount Kanchenjugha, Himalayan mountain range, Sikkim, India. Orange tint on the mountains at dawn. — Primary](https://www.zdnet.com/wp-content/uploads/sites/3/GettyImages-879472452.jpg)

OpenSSH 10.6p2 fixes an authentication bypass affecting Alpine Linux and potentially other distributions using the musl C library, ZDNET reported. Under specific configurations, an attacker who knows an account name can log into a password-disabled account by submitting a password between 257 and 1,024 bytes long.

Exposure requires password authentication, OpenSSH operating without PAM authentication support, an account whose password field is an asterisk, and another account with a 5 or 6 password hash. A library error returns an asterisk that matches the disabled account's stored field.

Alpine released patched versions on Thursday and fixed packages back to release 3.16. Administrators must restart the SSH daemon after upgrading; replacing the package leaves the running daemon unchanged.

## Sources

- [ZDNET](https://www.zdnet.com/tech/alpine-linux-openssh-patch-flaw/)

---
Canonical: https://techandbusiness.org/newswire/wOVBbQ6y8dYTbJe9EnYuJt
Published: 2026-11-07T05:06:41.246Z
Story chronology: 2026-11-07T00:00:46.000Z
Retrieved: 2026-11-08T06:08:53.101Z
Publisher: Tech & Business (techandbusiness.org)