OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux

OpenSSH released version 10.6p2 to address a critical authentication bypass flaw affecting musl-based Linux distributions such as Alpine Linux, OpenWrt, Buildroot, and Yocto. The vulnerability allows remote attackers with network access to log into passwordless accounts by submitting a password payload between 257 and 1,024 bytes long. The issue manifests when the OpenSSH daemon operates without Pluggable Authentication Modules (PAM) and has password authentication enabled alongside at least one password-protected account on the host.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's port module identifies exposed SSH services on port 22 and reads the publicly advertised OpenSSH service banner. It flags targets running vulnerable, unpatched OpenSSH versions prior to 10.6p2 for security review.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain