{
  "id": 18378084,
  "title": "OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux",
  "url": "https://urgent.news/2026/11/05/openssh-issues-emergency-fix-for-flaw-letting-long-passwords-bypass",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-05T16:42:46.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html"
  },
  "original_language": "en",
  "account": "A security flaw in the OpenSSH server for Alpine Linux allows attackers to bypass authentication when using long passwords. This affects servers running the openssh-server package without Pluggable Authentication Module (PAM), with password logins enabled, and at least one account with a password. Attackers need network access to the server and the name of an account with no password. OpenSSH rates this critical flaw. Version 10.6p2 of OpenSSH fixes the issue, which Alpine Linux has published for all releases back to 3.16. Non-Linux systems and Linux systems on glibc or using PAM are not affected. The flaw works through how sshd works with musl, the C library Alpine is built on. OpenSSH recommends setting PasswordAuthentication=no or disabling SSH immediately. The flaw is not limited to Alpine, affecting other musl-based systems like OpenWrt, Buildroot, and Yocto.",
  "summary": "Attackers can log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. They need network access to the server, an account name, and a password between 257 and 1,024 bytes long. OpenSSH, which rates the flaw critical, released version 10.6p2 today to block it. Alpine has published fixed packages for every",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}