OpenSSH 10.6p2 Emergency Release Closes Authentication Bypass on Alpine Linux

En bref

• OpenSSH shipped 10.6p2 outside its normal cadence to correct an authentication bypass.
• The flaw affected openssh-server builds delivered through Alpine Linux's standard package channels.
• Attackers could establish unauthorized sessions, including on accounts limited to public-key logins.
• Corrected Alpine packages are available; no CVE identifier has been assigned so far.

OpenSSH issued version 10.6p2 in November 2026 as an out-of-band correction, moving faster than its usual release rhythm to address an authentication bypass in the server daemon. The defect specifically concerns the openssh-server build that Alpine Linux ships through its normal package channels, so the exposure is tied to how the software was packaged and distributed rather than to one bespoke configuration.

The population at risk is administrators running Alpine hosts that pulled openssh-server from the distribution's standard repositories. Environments that compile OpenSSH themselves or run it on other platforms fall outside the described scope, though they should still confirm which version they are running.

What makes this notable is the nature of the bypass: it permitted sessions to be established without proper credential validation, and it extended to accounts configured to accept only public-key authentication. In other words, systems that had disabled password logins — a common hardening step — were not insulated from the flaw. That undercuts a control many teams treat as a dependable backstop.

No CVE identifier has been attached to the issue so far, which is unusual for a remote authentication weakness and may complicate tracking in vulnerability scanners and asset inventories. The 10.6p2 designation itself signals a patch-level release rather than a feature update, and corrected Alpine packages are already available.

For defenders, the priority is straightforward: update, then verify. Because unauthorized access may have occurred before the fix landed, log review matters as much as patching. Watch for a formal advisory or CVE assignment, and treat any unexplained session on an Alpine SSH host as worth investigating.

À faire maintenant

1. Run apk upgrade to pull the corrected openssh-server build, restart sshd, and confirm the running version reports 10.6p2 or the patched package revision.
2. Inventory every Alpine host that installs OpenSSH from distribution repositories, prioritizing internet-facing systems and jump hosts.
3. Search authentication logs for successful logins that lack a matching key fingerprint or that reached accounts restricted to public-key auth.
4. Audit authorized_keys files and account lists for entries you cannot attribute, and rotate keys or credentials on any host showing suspicious activity.
5. Until patching is complete, limit SSH reachability with firewall rules or a bastion host, and disable unused accounts.
6. Subscribe to Alpine and OpenSSH security channels to catch a CVE assignment or a revised advisory.

Source originale

The Hacker News