OpenSSH Password Bypass on Alpine Linux: Is Your Business Affected?

On November 5, 2026, the OpenSSH project released OpenSSH 10.6p2 with a critical fix for a password authentication bypass. OpenSSH is the software most Linux servers and devices use for SSH (Secure Shell) remote logins. The flaw is tracked as CVE-2026-123158 and rated 8.1 (High).

The short version: most businesses are not affected, but the ones that are should act now.

What Is the Problem?

On affected systems, an attacker who can reach the SSH port can log in to certain accounts without knowing the password. According to Alpine Linux's advisory, it takes one connection and works every time. The attacker only needs to send an unusually long password to an account that has no password set, which is common for accounts meant to use SSH keys only.

Who Is Affected?

The flaw only applies to Linux systems that run the OpenSSH server built with the musl C library and without PAM (Pluggable Authentication Modules). Alpine Linux is the best-known example, but custom firmware and embedded devices built the same way can also be affected.

An Alpine system is exposed only when all of these are true:

• It runs the standard openssh-server package (built without PAM), or the PAM version with PAM turned off.
• Password logins over SSH are enabled, which is the default.
• At least one account has no password set.
• At least one other account does have a password.

Who Is Not Affected?

• Windows and macOS systems.
• Common Linux distributions such as Ubuntu, Debian, and Red Hat Enterprise Linux, which use a different C library (glibc) and PAM.
• Systems with SSH password logins turned off.
• Alpine-based Docker containers that don't run an SSH server.

What to Do Now

1. Find systems that might be affected. Look for Alpine servers, virtual machines, appliances, and containers that accept SSH logins, especially any reachable from the internet.
2. Update and restart. On Alpine, install the fixed openssh package with apk upgrade -U -a, then restart the SSH service. Updating alone does not replace the copy that's already running.
3. If you can't update yet, turn off SSH password logins. Set PasswordAuthentication no and restart SSH. Confirm SSH key login works first so you don't lock yourself out.
4. Ask your vendors. If you use network appliances or other devices built on embedded Linux, check whether the manufacturer has issued guidance.

Good practice either way: use SSH keys instead of passwords for remote logins, and limit SSH access so it is not open to the whole internet.

Patching Faster Matters More Than Ever

OpenSSH released this fix within a day of learning about the problem. The project says it is now shipping security fixes faster because AI tools are helping people rediscover reported bugs, sometimes within hours. For businesses, that shrinks the time between a public disclosure and a possible attack.

Need Help Checking Your Systems?

If you're not sure whether anything in your environment runs Alpine or embedded Linux with SSH enabled, contact Grand Rapids Tech. Our cyber security and managed IT teams can help you find out where you stand and keep critical updates moving.