OpenSSH 10.6p2 shipped on November 5, 2026, and it closes a critical password authentication bypass. On affected systems, anyone who can reach the SSH port can log in without knowing a password.
If you run sshd on musl-based Linux with pluggable authentication modules (PAM) disabled, Alpine Linux being the common example, upgrade today.
At Check Point Software, our testing adds two points to the public advisory. The attack needs a second account that is active and has a real password, because a stored hash alone is not enough. Two conditions are also visible remotely before login: the OpenSSH version in the SSH banner, and whether the server accepts password authentication. Servers that don’t offer passwords are not exposed.
Without PAM, sshd hashes the password attempt with crypt() and compares the result to the stored field. When an account has no salt, sshd borrows the salt from another account. musl’s crypt() returns an asterisk (*) as an error when the input exceeds 256 bytes, and accounts with no password also store *. A password of 257 to 1,024 bytes therefore “matches,” and the login succeeds.
According to the Alpine Linux advisory, the attack takes one connection, works every time, and needs no retries.
All of these conditions must be true:
- sshd runs without PAM on musl-based Linux, such as Alpine’s default openssh-server package, or openssh-server-pam with UsePAM set to no
- PasswordAuthentication is yes, which is the OpenSSH default
- An account has * in its password field, such as key-only users, directory users through musl-nscd, or the alpine user in official tiny-cloud images
- At least one other active local account has a real password stored as a $5$ or $6$ hash
The last condition matters because sshd borrows that account’s salt. Without it, the attack fails. Our testing found the account must be active, not just hold a hash.
Root is safe under the default PermitRootLogin prohibit-password. Any reachable account with doas or sudo rights can still become root, though. glibc Linux, non-Linux systems, and Linux with PAM are not affected, according to OpenSSH developer Damien Miller.
The banner reveals the OpenSSH version, and the server’s list of allowed authentication methods shows whether it accepts passwords. The remaining conditions, including musl, PAM, account states, and password hashes, need a check on the host itself.
Version strings can mislead here. Alpine’s fixed packages keep older version numbers, such as 10.3_p1-r2 on Alpine 3.24, so a patched host can look vulnerable. No CVE is assigned as of November 5, 2026, so CVE-based scanners may not flag affected systems either. Check musl-based hosts manually.
Alpine ships patched packages for 3.16 through 3.24 and edge. Upgrade, then restart sshd, because the package upgrade does not restart the running daemon. If you can’t patch yet, set PasswordAuthentication no.
To check for compromise, search your logs for “Accepted password for” an account that has no password. If you can’t rule out a login, treat the machine as compromised.
A fix only helps on hosts you know about, and a bug with no CVE is easy to miss in workflows that start from CVE lists.
The better starting point is asset context: which internet-facing servers run SSH, which of them accept passwords, and which are Alpine containers. Attack surface management in Check Point Exposure Management gives security teams that list from one source, so they can patch the exposed hosts first and work inward from there.
The OpenSSH team released the fix one day after learning of the bug. Its reasoning is that AI agents now rediscover bugs, sometimes within hours, so long embargoes mainly help attackers. Releases follow the same logic. Five shipped in 2026, four of them after July, and the team now ships fixes as they land.
Plan for an update every one to two months, and track the release notes or the openssh-unix-announce mailing list. The 10.x line also retires DSA keys, makes hybrid post-quantum key exchange the default, and starts deprecating scp -R, so each upgrade deserves a quick compatibility review.
Patch musl-based hosts that run sshd without PAM first, restart the daemon, and turn off password authentication anywhere you can’t patch today.
Check Point Exposure Management connects threat intelligence, attack surface management (ASM), cyber asset attack surface management (CAASM), Agentic Exposure Validation (AEV), and Safe Remediation in one workflow.
Check Point Threat Intelligence shows which threats and threat actors target your organization, while ASM discovers the internet-facing assets attackers can reach, including ones no one has tracked. CAASM pulls data from the tools you already own into one inventory of your internal assets and shows where coverage has gaps. Agentic Exposure Validation then tests which exposures can be exploited in your environment, so teams act on the critical findings first. Safe Remediation closes those exposures with changes validated up front, so fixes do not disrupt production.
