Security AlertCritical
OpenSSH flaw lets attackers log into some password-blocked Linux accounts
Nov 5, 2026 · Summarized by Fundy Tech from BleepingComputer
The 30-second version
A new OpenSSH flaw can let attackers log into certain musl-based Linux accounts by sending an oversized password. Alpine Linux admins should update OpenSSH now.
Key points
- The flaw affects some Alpine Linux and other musl-based systems.
- It can allow login to accounts set to block password authentication.
- OpenSSH 10.6p2 fixes the issue.
- Temporary mitigation is to disable SSH password authentication.
Why it matters
If you run affected Linux servers, an attacker may get in without a valid password. That could expose business systems, customer data or remote admin access.
Who’s affected: Some Alpine and other musl-based Linux servers
What to do
- Update OpenSSH to 10.6p2 or later.
- Turn off SSH password authentication if you cannot update yet.
- Check SSH logs for suspicious logins to blocked accounts.
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.