OpenSSH 10.6p2 blocks long

Feeds.4Sysops •IT News • November 6, 2026

OpenSSH, used for secure remote logins to Linux servers, has released version 10.6p2 to close a critical authentication bypass affecting some Alpine Linux systems. Attackers could use an oversized password to access accounts with no password set when password authentication was enabled and the server checked passwords without PAM. Alpine has issued patched packages; until systems are updated, administrators should disable password logins. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OpenSSH Vulnerability Allows Password Bypass on Alpine Linux On November 5, 2026, OpenSSH released version 10.6p2 to address CVE-2026-123158, a critical vulnerability that allows attackers to bypass password authentication on Alpine Linux and other musl-based systems. The flaw, discovered by Özgün Kültekin, enables unauthorized access to accounts with no password set by submitting a long password (between 257 and 1024 characters). This issue primarily affects systems running OpenSSH without PAM (Pluggable Authentication Modules) and where password authentication is enabled. The vulnerability has been confirmed to impact Alpine Linux cloud images, which often include a default 'alpine' user that can gain root access without a password. As of November 6, 2026, reports indicate that exploitation attempts have already been observed in the wild. Administrators are urged to apply the patch immediately or disable password authentication to mitigate risks. 47 sources 72

Extracted Entities

OpenSSH 10.6p2 blocks long

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (2)

Platforms (3)