OpenSSH Emergency Patch Fixes Long-Password Auth Bypass on Alpine Linux

OpenSSH has released version 10.6p2 to fix a critical authentication bypass affecting certain Alpine Linux servers running the standard openssh-server package. According to The Hacker News, the flaw lets an attacker with network access to the server, a valid account name, and a password between 257 and 1,024 bytes long authenticate into accounts that have no password set. This includes SSH key-only accounts. Alpine has published fixed packages for affected releases.

Why It Matters

This is an authentication bypass. It undercuts the assumption that key-only accounts cannot be logged into with a password. Organizations running Alpine Linux, which is common in container base images and lightweight server deployments, are at risk if the stock openssh-server service is network-reachable and account names can be guessed. OpenSSH rates the flaw critical.

What Defenders Should Do Now

• Identify any Alpine Linux hosts and container images running openssh-server, especially those exposed to untrusted networks, and prioritize patching to OpenSSH 10.6p2 or the corresponding fixed Alpine package.
• Audit SSH authentication logs for unusual successful logins to accounts expected to be key-only or password-less, particularly where the authenticating password is unusually long.
• Where immediate patching is not possible, restrict SSH access with network controls such as allow-listing or bastion-only access, and disable password authentication if it is not already off.
• Review container base images and CI/CD pipelines for pinned, outdated Alpine or openssh-server versions that may need rebuilding.

This is a developing advisory and details may be refined as further analysis is published. For the original report, see The Hacker News.