OpenSSH: long password vulnerability

OpenSSH

Decade-old vulnerability in OpenSSH allows root access with overly long password

Do this now

Upgrade OpenSSH to version 10.6p2 or later now.

Who should check: teams running OpenSSH

First seen: 5 Nov 2026
Last update: 6 Nov 2026, 00:17 UTC
Fixed in: 10.6p2
Source: news
On the menu as: OpenSSH

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## OpenSSH: long password vulnerability
Severity: critical. Patch status: patched.
Affected: OpenSSH
Fixed in: 10.6p2

Decade-old vulnerability in OpenSSH allows root access with overly long password

## Steps
1. This touches infrastructure (openssh). Look in terraform, ansible, cloud-init, Dockerfiles and docs for the product and version we run. If it isn't in the repo, say so and list what a human should check on the box.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910 https://seclists.org/oss-sec/2026/q4/522 https://seclists.org/oss-sec/2026/q4/528 https://thehackernews.com/2026/11/openssh-issues-emergency-fix-for-flaw.html https://seclists.org/oss-sec/2026/q4/534 https://seclists.org/oss-sec/2026/q4/535 https://seclists.org/oss-sec/2026/q4/537
https://pwned.coffee/i/openssh-long-password-vulnerability

Timeline

6 Nov 2026, 00:17 UTC
Reported by seclists.org: Re: "sshole": password authentication bypass: OpenSSH + musl libc
5 Nov 2026, 22:17 UTC
Fix status: unknown → patched.
5 Nov 2026, 22:17 UTC
Reported by thehackernews.com: OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
5 Nov 2026, 20:17 UTC
Reported by seclists.org: Re: "sshole": password authentication bypass: OpenSSH + musl libc
5 Nov 2026, 19:19 UTC
Fix status: patched → unknown.
5 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
Score: No CVSS published yet: severity unknown.
Last checked: 5 Nov 2026, 21:18 UTC

Sources: KEV – CVE record – Vendor –

Sources

Follow on X

Totalone very hot coffee