Overview
- Multiple vendors and OpenSSH released fixes on Thursday, November 5, 2026, and administrators must install OpenSSH 10.6p2 or Alpine’s patched packages and then restart the running sshd to fully remediate the issue.
- Successful exploitation required four specific conditions: an OpenSSH build running without PAM, PasswordAuthentication enabled, at least one account whose /etc/shadow password field is a single asterisk (*), and at least one local account with a $5$ or $6$ password hash.
- The vulnerability happened because musl’s crypt() returns "*" for hashing errors on passwords longer than 256 bytes and sshd, when no salt is present, borrows another account’s salt and compares the result, producing a matching "*" and immediate login.
- If you cannot update right away, set PasswordAuthentication no and restart sshd as a temporary fix, and review /var/log/messages for lines like "Accepted password" for accounts that should be passwordless; treat any unclear cases as possible compromise.
- The bug traces to musl changes in 2012 and an OpenSSH change in 2016 to always hash attempts, and security teams warn that opportunistic scanning and long-password brute-force attempts are likely to appear quickly as attackers add this check to automated tools.