OpenSSH 10.6p2 closes a password bypass on musl Linux without PAM

OpenSSH 10.6p2 closes a password bypass on musl Linux without PAM

5 November 2026: The OpenSSH project has released portable OpenSSH 10.6p2 with what it calls a critical security workaround. On Linux systems that use the musl C library and have PAM disabled, password authentication to sshd can be bypassed. "If you operate a Linux system that uses musl libc without PAM (Alpine Linux is one example) then stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY," wrote Damien Miller, one of the maintainers. Linux systems on glibc, Linux systems that use PAM for passwords, and non-Linux systems are not affected.

Not yet independently verified. No CVE number had been published when we wrote this, and the release notes do not describe the flaw beyond the conditions it needs; the maintainers place its root cause outside OpenSSH. We will update this when it can be confirmed, and remove this note.

Where the flaw sits and why the release came fast

The release notes describe an sshd password authentication bypass that affects some Linux systems "when built and run with PAM support disabled". The maintainers consider the root cause to be outside sshd, but the bug can be exploited through it and avoided there, so the workaround ships in OpenSSH. Özgün Kültekin of Wakefield reported it. Miller says the team learned of the problem the day before the release and shipped as fast as it could, because it has "recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours". He calls long embargo periods "a dangerous practice that primarily benefits attackers". He also thanked Alpine Linux's developers for making an updated package available at very short notice.

Which machines to look at first

Alpine is the best known Linux distribution built on musl, and it is the base of a large share of small container images. Few production containers should run sshd at all, but bastion hosts, appliances, CI runners and lightweight virtual machines often do. An estate owner can check in this order:

• list hosts and images whose C library is musl rather than glibc;
• on those, check whether sshd accepts passwords (PasswordAuthentication in sshd_config, or sshd -T) and whether it was built with PAM;
• where it does and has no PAM, set PasswordAuthentication=no, or stop sshd, until the package is upgraded;
• upgrade to OpenSSH 10.6p2 or the distribution's patched package, and confirm the version on each host.

Machines that already allow only key-based logins are outside the path the maintainers describe.

Other changes in 10.6p2

The release also allows the post-quantum hybrid signature scheme ssh-mldsa44-ed25519 as a CA signature algorithm, and fixes a short CPU spin when ChannelTimeout is used. It carries the deprecations announced with 10.6: scp's -R flag for remote-to-remote copies now prints a warning and will later be ignored, and support for very old platforms that need root for PTY allocation without file descriptor passing will be removed. The team says it will, for now, make more frequent releases rather than batch fixes.

Sources

• OpenSSH release notes: OpenSSH 10.6p2 (2026-11-05), 5 November 2026
• Damien Miller (OpenSSH): OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability, 5 November 2026