OpenSSH 10.6p2 Closes musl Password Bypass Enabling Key-Only Account Takeover on Alpine

The vulnerability stems from sshd's password verification path when compiled against musl instead of glibc. A single long password string bypasses the expected failure for passwordless accounts once any other account holds a $5$ or $6$ hash. Alpine's default openssh-server package ships without PAM and with PasswordAuthentication enabled, satisfying three of the four exposure conditions listed in the project's advisory. Root remains protected by prohibit-password unless an exposed account can escalate via doas, which tiny-cloud images 3.18.11-3.24.3 permit for the alpine user.

Kültekin's technical report and OpenSSH commit logs show the root cause is an unchecked buffer interaction between sshd and musl's shadow handling that glibc and PAM paths never trigger. No in-the-wild exploitation has been observed, yet the single-connection success rate and default settings on Alpine cloud images create a low-friction vector once any local password is set. Older Alpine branches past end-of-support still received backported packages, indicating the maintainers treated the issue as systemic rather than isolated.

Containers without sshd, systems enforcing PasswordAuthentication no, and glibc distributions remain unaffected. The pattern matches prior musl edge cases in authentication libraries where assumptions from glibc-dominated codebases were not revalidated. Operators must both upgrade and explicitly restart sshd; package updates alone leave the running daemon exposed.

Next steps include scanning for PermitRootLogin yes combined with doas rules and enforcing key-only auth across all Alpine fleets within 72 hours.