Alpine Linux published an advisory on November 5, 2026 about a password-authentication bypass in its openssh-server package. If you run an SSH server on Alpine, read that advisory before anything else today. It is the page that spells out exactly who is affected.
For the upstream side, see the OpenSSH 10.6p2 release notes.
An authentication bypass on an SSH server is about as serious as server bugs get, because SSH is often the front door to the whole machine. Until you have read the advisory, put any Alpine host with SSH reachable from the internet at the top of your list to check.
What this article cannot confirm yet
The research behind this piece could not verify the details inside either page. So the following are open questions, and you should get the answers from the Alpine advisory itself rather than from headlines:
- The CVE identifier, if one has been assigned.
- Which openssh-server package versions are affected, and which version fixes it.
- Whether Docker containers and embedded devices built on Alpine are in scope.
- Whether there is a recommended
sshd_configchange, such as turning off password logins, as a stopgap.
If you see claims about any of these elsewhere, check them against the Alpine post before acting.
How to work out whether your server is exposed
- Confirm whether the machine or container runs Alpine Linux.
- Confirm whether it runs an SSH server at all. Many containers do not.
- In the Alpine advisory, find the affected and fixed openssh-server package versions it lists. Use the fixed version as the line for every Alpine host and image you own, and follow the advisory's own instructions for checking and updating the package.
- Read the OpenSSH 10.6p2 notes to see what the upstream release changes.
- Apply whatever update or mitigation the Alpine advisory recommends, including any guidance it gives about container images.
