OpenSSH flaw lets long passwords bypass login on Alpine Linux
A critical OpenSSH flaw lets oversized passwords log in to password-less accounts on some Alpine Linux servers. See who is affected and how to fix it.
TL;DR: A critical OpenSSH flaw lets an attacker sign in to password-less accounts on some Alpine Linux servers by sending a very long password. OpenSSH released version 10.6p2 to block it, so update the package.
What happened
The Hacker News reported that OpenSSH shipped an emergency fix on November 5, 2026. On some Alpine Linux servers that use the standard openssh-server package, an attacker can sign in to an account with no password set, such as one that only accepts SSH keys. They need to reach the server over the network, know an account name and send a very long password, from 257 up to 1,024 bytes. OpenSSH rates the problem critical, and its fix is version 10.6p2. Alpine has also published updated packages, so check Alpine's own advisory for the exact package version to install.
Am I affected?
You are affected if you run Alpine Linux with the standard openssh-server package and the server is reachable over the network, including container images built on Alpine that run an SSH server. Check the installed version with sshd -V or apk info openssh-server and compare it with Alpine's advisory. Until you can update, limit SSH access to trusted networks.
How to check with Stackurity
Stackurity reads installed packages on Alpine servers and matches them against advisories, so you can list every server or image that still carries the old package. Appliance firmware is not covered, and neither are copies of software bundled outside a package manager. After you update, check again records whether the issue is gone. See how Stackurity handles fixes. Stackurity Cloud has a 14-day free trial without a card: Start a free trial.
