Skip to content
Centoculus

Security alert · Critical

OpenSSH on Alpine Linux: login without password via overlong passwords

· 3 minutes read · Centoculus Security Team

Known since

Affected: OpenSSH (openssh-server package) on Alpine Linux before OpenSSH 10.6p2 / Alpine fixed packages

What happened

On 5 November 2026 the OpenSSH project released OpenSSH 10.6p2 as an emergency fix for a critical authentication bypass that affects Alpine Linux. On Alpine servers that use the standard openssh-server package, an attacker can log in to accounts that have no password set, for example accounts that are meant to be used with SSH keys only.

All the attacker needs is a valid account name and a password between 257 and 1,024 bytes long. OpenSSH 10.6p2 blocks this, and Alpine has published fixed packages. There are no reports of active exploitation so far, but the conditions for an attack are simple, so it should be expected soon.

Who is affected

  • Alpine Linux servers and virtual machines running the standard openssh-server package that has not been updated since the fix.
  • Containers and images based on Alpine that include and run sshd.
  • Any account without a password is a possible target, including key-only accounts. Attackers have to know or guess the account name, so common names such as root, admin, deployment or backup users are the most exposed.

Other distributions are not named as affected in the reports about this issue.

What to do now

  1. Find all Alpine systems that run an SSH server: cat /etc/alpine-release and apk info -e openssh-server.
  2. Keep an existing SSH session open as a fallback while you update.
  3. Update the package index and OpenSSH: apk update && apk upgrade openssh openssh-server.
  4. Restart the SSH daemon so the fixed version is in use: rc-service sshd restart.
  5. Open a second, new SSH session to confirm you can still log in before you close the old one.
  6. For Alpine-based container images that run sshd, rebuild the images on an updated base and redeploy the containers. Updating a running container alone is lost on the next redeploy.
  7. Until all systems are updated, restrict access to port 22 with a firewall or security group to known administrator IP addresses.

For the exact fixed Alpine package versions, check the Alpine and OpenSSH advisories linked below.

How to check whether you are affected

  • Check the installed version with apk info -v openssh-server and ssh -V, and compare it with the fixed packages listed in the advisories linked below. Systems not updated since 5 November 2026 should be treated as vulnerable.
  • Confirm that the running sshd was restarted after the update, for example by checking the process start time with ps -o pid,etime,args | grep sshd.
  • Review your SSH logs (on Alpine usually /var/log/messages or /var/log/auth.log, depending on your syslog setup) for Accepted password for entries on accounts that should only ever log in with keys. Such entries on key-only accounts are a strong sign of compromise.
  • Look for unexpected logins, new entries in ~/.ssh/authorized_keys, new user accounts or unknown cron jobs on systems that were reachable from the internet. If you find signs of misuse, isolate the system and rebuild it from a trusted source rather than cleaning it up in place.

Sources

More sources (1)

If you run Linux servers, also check

Related posts