Security advisory: openssh-server password authentication bypass

Alpine Linux released patched openssh-server packages on November 5, 2026, fixing a password authentication bypass that lets an attacker log in without credentials by sending a 257-to-1024-byte password when the target machine has at least one account with a `$5$` or `$6$` shadow hash and another account whose password field is `*`. The flaw affects every Alpine release from 3.16 through 3.24 and edge when PasswordAuthentication is enabled and the server runs without PAM, including the default `root:*` entry and key-only accounts created without passwords; openssh-server-pam with UsePAM yes, containers not running sshd, and systems with password logins disabled are unaffected. Upgrading the package alone is insufficient because the running daemon must be restarted, and administrators who cannot patch immediately can set PasswordAuthentication no as a stopgap. No CVE identifier had been assigned at the time of writing, and the details appear in the OpenSSH 10.6p2 release notes. Watch for a CVE assignment and for confirmation that downstream Alpine-derived images and directory-service setups using musl-nscd have picked up the fixed builds.