What Happened: EnterProtect OpenSSH Vulnerability
A critical EnterProtect OpenSSH vulnerability is now public. Attackers can log in to certain Alpine Linux and other musl-based Linux accounts that were configured to block password authentication, simply by sending an oversized password. OpenSSH rates the flaw critical and has released version 10.6p2 to block it. For an MSP, the cost is a client server that should be locked down but is not. Update to 10.6p2 and apply Alpine's fixed packages now.
The flaw is called *sshole. The attack needs network access to the server, an account name and a password between 257 and 1,024 bytes long. It works against accounts that should not accept a password at all, such as SSH key-only accounts on Alpine Linux servers running the standard openssh-server package.
OpenSSH released version 10.6p2 to block the flaw, and Alpine has published fixed packages. The sources do not list a CVE for this issue yet. That does not make it less urgent. The patch is available, and the attack is simple to run.
For an MSP, the real exposure is the gap between the patch being available and the patch being applied. Attackers move fast when a public exploit is this simple. The window to protect clients is now.
Timeline
- 2026-11-05: OpenSSH released version 10.6p2 to block the flaw, according to Hacker News.
- 2026-11-05: BleepingComputer reported the flaw, saying attackers can log into password-disabled accounts with an oversized password.
- 2026-11-06: SecurityWeek reported that OpenSSH rushed patches for the SSHole authentication bypass.
Who Is Affected
Affected systems are certain Alpine Linux and other musl-based Linux accounts configured to block password authentication. In practice, that includes accounts with no password at all, such as SSH key-only accounts, on Alpine Linux servers running the standard openssh-server package.
The issue appears on Linux distributions using musl libc without PAM. Some of those accounts accept any password between 257 and 1,024 characters. If a client runs Alpine in a container, on a VPS or on an edge device, this is worth checking.
This is not every Alpine server. The sources describe certain Alpine Linux and other musl-based Linux accounts, so inventory before you assume.
Why This Matters for MSPs
This is the kind of flaw that turns a control meant to block logins into an open door. Password authentication is often disabled on key-only accounts, and this bypass defeats that control. A client with an Alpine server exposed to the internet is at risk.
The attack does not require stolen credentials. It needs only network access, a username and a long password. That is a low bar. In general, any authentication bypass that skips a control should be treated as an emergency, because the normal warning signs do not apply.
MSPs should treat this as an emergency patch event. Update OpenSSH to 10.6p2 and apply Alpine's fixed packages, then check logs for anything unusual.
A single missed client can cost an MSP a week of incident response and a damaged reputation. The fix here is known and available. The work is finding every affected system and updating it.
Technical Details
The sources list no CVE identifier for this issue.
Product: OpenSSH. Affected configurations: Linux distributions using musl libc without PAM, including certain Alpine Linux servers running the standard openssh-server package.
Attack vector: network access to the server, a valid account name, and a password between 257 and 1,024 bytes long. On affected systems, some accounts accept any password in that range.
Fixed version: OpenSSH 10.6p2. Alpine has published fixed packages. The sources do not name a specific affected OpenSSH version range.
What MSPs Should Do
Act now. The patch is out, the attack is simple, and the sources rate the flaw critical. The steps below are the immediate response.
- Update OpenSSH to version 10.6p2 on all affected systems.
- Apply the fixed packages Alpine has published for the openssh-server package.
- Inventory client systems running Alpine Linux or other musl-based distributions without PAM.
- Audit accounts configured to block password authentication, especially key-only accounts, for signs of unauthorized access.
- Review authentication logs for successful logins with passwords in the 257 to 1,024 byte range.
- If you find a compromise, isolate the server, rotate keys and credentials, and restore from a known clean backup.
What to Tell Clients
Clients need a clear message: this is a critical OpenSSH flaw, and their Alpine Linux or other musl-based systems need an emergency patch. Explain that the fix is OpenSSH 10.6p2 and that Alpine has published fixed packages.
For clients that cannot patch immediately, restrict network access to SSH on affected systems and review authentication logs. In general, limiting SSH exposure to trusted IPs reduces the attack surface.
Do not wait for a client to report a problem. Patch first, then check logs. The cost of an unpatched server is far higher than the cost of an emergency maintenance window.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of client systems, so a compromised server can be brought back to a known good state.
EnterProtect recovery gets a client running again after an incident, which is what matters when a server is down and the client is losing money.
EnterProtect vulnerability scanning finds exposed versions of software across the environments you manage.
The backup and recovery pieces are part of a standard incident response posture. When a patch goes wrong or a server is compromised, a restorable copy is the difference between a quick recovery and a long outage.
Frequently Asked Questions
What Is the OpenSSH *Sshole Vulnerability?
*sshole is a critical authentication bypass in OpenSSH. On certain Alpine Linux and other musl-based Linux systems without PAM, an attacker can log in to an account that is configured to block password authentication by sending a password between 257 and 1,024 bytes long. OpenSSH released version 10.6p2 to fix it.
Which Systems Are Affected by the OpenSSH Flaw?
Affected systems are certain Alpine Linux and other musl-based Linux accounts configured to block password authentication, including key-only accounts on Alpine servers running the standard openssh-server package. The issue appears on Linux distributions using musl libc without PAM.
How Does the *Sshole Attack Work?
The attacker needs network access to the server and a valid account name. They send a password between 257 and 1,024 bytes long, and the affected system accepts it even though the account was set up to reject password logins.
Is There a Fix for the OpenSSH Authentication Bypass?
Yes. Update to OpenSSH version 10.6p2 and apply the fixed packages Alpine has published. Treat this as an emergency patch, since OpenSSH rates the flaw critical and the attack is simple.
How Can an MSP Check for Signs of Compromise?
Review authentication logs for successful logins from unexpected sources and for login attempts with unusually long passwords in the 257 to 1,024 byte range. Also audit key-only accounts for new SSH keys or changes to authorized_keys files. If you find signs, isolate the server and restore from a known clean backup.
Sources
- OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux (Hackernews)
- OpenSSH flaw lets attackers log into password-disabled Linux accounts (Bleepingcomputer)
- OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass (Securityweek)