Overview
- OpenSSH released emergency build 10.6p2 on Thursday, November 5, 2026, and distributions including Alpine published patched packages to close a bypass that accepted 257–1,024 byte passwords.
- The flaw only affects OpenSSH servers on musl-based Linux builds run without PAM with PasswordAuthentication enabled, and it requires one account with a '*' password field plus at least one $5/$6 hashed password on the same machine.
- On vulnerable systems an attacker who knows a username for a '*' account can open a single SSH connection and succeed by sending an oversized password, so operators must update packages and restart sshd because upgrading alone does not restart the running daemon.
- If operators cannot patch immediately they should set PasswordAuthentication no and verify key-based logins, and administrators should inspect SSH logs for 'Accepted password' entries for accounts that should be passwordless and treat uncertain cases as compromises.
- The root cause traces to musl changes in 2012 that return '*' on crypt() failure and a 2016 OpenSSH change that hashes even when a stored hash is missing, which together let musl return a '*' that matches a '*' shadow entry and produce a successful login.