For: anyone running sshd on musl-based Linux such as Alpine (servers, VPSs, Docker images, routers and other embedded devices), the infrastructure staff responsible, and people who leave operations to a contractor. This article is based on the OpenSSH release notes, the CVE and NVD records and Alpine Linux's advisory. It does not cover attack steps.
Developing: this article will be updated as more is published
- Who is affected
anyone running sshd on musl-based Linux such as Alpine (servers, VPSs, Docker images, routers and other embedded devices), the infrastructure staff responsible, and people who leave operations to a contractor.
- Confirmed so farSee the table ↓
- The problem
- CVE
- Scope
1 more
- Alpine fixes
- Not yet confirmed
- Scale and success of exploitation (attempts are reported but no independent verification was found)
- Whether CISA adds it to the Known Exploited Vulnerabilities catalog (not listed in data updated November 4)
- NVD's own assessment (not yet analysed on November 6; the 8.1 base score is from the CVE record)
1 more
- Status of distributions and images other than Alpine (no official statements found)
- What to do nowSee the steps ↓
- Check whether sshd runs, and which libc and PAM it uses
- Update and restart sshd
- If you cannot update, turn off password authentication
2 more
- Rebuild containers and cloud images
- Review authentication logs
- Where to verify (source)All sources ↓
- OpenSSH Release Notes, 10.6p2 (November 5, 2026)
- Last checked
- As of November 7, 2026 (JST)
Follow-up plans and what we checked
The OpenSSH release notes say 10.6p2 (November 5, 2026) avoids a password-authentication bypass exploitable through sshd on some Linux systems built and run without PAM. They also say the root cause is outside sshd. It is registered as CVE-2026-123158.
What to do today
Check whether sshd runs, and which libc and PAM it uses
First see whether sshd runs on the host or in the container. Alpine's advisory lists containers that do not run sshd as not affected. If it does run, check for musl with ldd $(which sshd); on Alpine, cat /etc/os-release also tells you. Also look at UsePAM in sshd_config and whether the installed package is openssh-server (no PAM) or openssh-server-pam.
Update and restart sshd
On Alpine, run apk upgrade -U -a. Fixed package versions differ per branch (table below). Updating the package does not replace the running daemon, so restart sshd, and keep a second session open so you are not locked out.
If you cannot update, turn off password authentication
Set PasswordAuthentication no so only keys work, and confirm with sshd -T | grep -i passwordauthentication. Make sure your key works first. Also keep sshd off the internet and restrict source addresses with a firewall or bastion. Key handling is covered in SSH keys with least privilege.
Rebuild containers and cloud images
If you install sshd in an Alpine-based image, update the base image and the openssh package and rebuild. Instances started from old images need updating one by one, or rebuilding from a fixed image. Alpine's advisory says its official cloud images (tiny-cloud) also have affected versions.
Review authentication logs
Alpine advises searching logs such as /var/log/messages for accepted password logins to accounts that should have no password: root, key-only users and the default user of cloud images are typical. If you find one, or logs are gone and you cannot rule it out, treat the host as compromised and check users, keys, configuration and files. See Checking a server for signs of intrusion and What to do when a vulnerability is published.
musl, no PAM, sshd exposed
Top priority. Update and restart; turn off password login until then
musl but not exposed
Update soon. Restrict sources and review logs
No sshd, PAM on, or passwords off
Not affected per Alpine. Normal update is enough
What OpenSSH and Alpine published
The OpenSSH project released Portable OpenSSH 10.6p2 on November 5, 2026. Its release notes open by saying the release contains a critical security workaround for Linux systems that use musl libc with PAM disabled.
- Content
- A change to avoid a password-authentication bypass exploitable through sshd on some Linux systems built and run with PAM disabled. The notes consider the root cause to be outside sshd but avoidable there
- Fixed version
- Portable OpenSSH 10.6p2
- Reporter
- A researcher at a private security company (as credited in the notes)
- Exploitation
- The notes do not mention exploitation
- Registration
- CVE-2026-123158, published November 5, 2026 (assigned by MITRE)
- Scope
- OpenSSH before 10.6p2, on Linux, when musl libc is used without PAM. Alpine Linux is given as an example
- Score
- CVSS 3.1 base score 8.1 (High), from the CVE record. NVD showed the entry as received on November 6, with no analysis of its own
- CISA annotation
- CISA's assessment attached to the record (SSVC) lists exploitation as proof-of-concept, automatable as no, technical impact as total
- Affected
- openssh-server (no PAM), or openssh-server-pam with UsePAM no. Branches 3.21 to 3.24 and edge, plus unsupported 3.16 to 3.20 (3.21 reached end of support on November 1). Official cloud images (tiny-cloud) 3.18.11 to 3.24.3
- Conditions (all)
- PasswordAuthentication is yes (the OpenSSH default); an account has an asterisk as its password field (root with PermitRootLogin yes, key-only users, directory-service users, the tiny-cloud default user); and another local account has a password hash in the $ format
- Not affected
- Containers that do not run sshd, PasswordAuthentication no, openssh-server-pam with UsePAM yes, locked accounts (marked with !) cannot log in by themselves; setups with no account holding a $-format hash, and cloud-init setups that write PasswordAuthentication no, are also out of scope
Alpine fixed versions (openssh)
| Branch | Fixed version |
|---|---|
| edge | 10.6_p2-r0 |
| 3.24 | 10.3_p1-r2 |
| 3.23 | 10.2_p1-r1 |
| 3.22 | 10.0_p1-r11 |
| 3.21 | 9.9_p2-r1 |
| 3.20 | 9.7_p1-r6 |
| 3.19 | 9.6_p1-r3 |
| 3.18 | 9.3_p2-r4 |
| 3.17 | 9.1_p1-r7 |
| 3.16 | 9.0_p1-r6 |
Alpine keeps each branch's version number and ships a patched package build, so the fix is not always a move to 10.6p2. Fixed tiny-cloud images are 3.21.10, 3.22.8, 3.23.8 and 3.24.4 and later.
Exploitation
What this site could confirm as of November 7, 2026:
- OpenSSH and Alpine
- Neither mentions exploitation
- KEV
- Not in CISA's KEV (data checked was updated November 4, 20:00 UTC)
- CISA assessment
- The CVE record's SSVC says proof-of-concept, which is separate from observed exploitation. The press also reported that a proof-of-concept has been published (not linked here)
- Private report
- Help Net Security (November 6) reports that a private threat-intelligence firm saw attack attempts less than nine hours after publication, including a root session on its own monitoring environment. The firm's own page says its confirmed label does not mean an attempt succeeded. The article relays the company's statements and reports eight attempts from a single source, caught by one sensor. The company's own page (as of November 6) counts 4 attempts on one sensor. Both numbers are small and no independent verification was found
This site's view: official sources and KEV do not confirm exploitation, but a private firm reports attempts. The numbers are small and unverified. Still, because the information needed to attack is already circulating, waiting for more reports is not advisable. Update internet-facing Alpine sshd first.
What is known and not known
| Item | What was published | Status |
|---|---|---|
| The problem | A password-authentication bypass via sshd on some Linux without PAM; worked around in 10.6p2 (OpenSSH) | Confirmed (OpenSSH) |
| CVE | CVE-2026-123158 (CVE record) | Confirmed |
| Scope | Before 10.6p2, Linux, musl without PAM; Alpine as example (CVE record) | Confirmed (CVE record) |
| Alpine fixes | Fixed packages for every branch 3.16 to edge (Alpine) | Confirmed (Alpine) |
| Conditions | Password auth on; an asterisk account and a $-format-hash account together (Alpine) | Alpine's description |
| glibc (Debian, RHEL families) | Official sources scope it to musl without PAM; statements that glibc is safe appear only as a researcher's statement relayed by the press | No explicit official statement |
| Other musl systems | The press, relaying a researcher, named other musl systems and embedded uses as worth checking; no distribution statements found | Unconfirmed |
| Numeric score | 8.1 from the CVE record; NVD not yet analysed | Partial |
| Exploitation | Attempts reported by a private firm; no independent verification found | Reported (unverified) |
| CISA KEV | Not listed in data updated November 4 | Not listed |
If someone else runs your servers
If you use a contractor's servers, VPSs or container platform, ask three things.
- Does sshd run, and if so is it musl-based (such as Alpine) without PAM?
- Was it updated to 10.6p2 or the distribution's fixed package, and sshd restarted? When?
- Is password authentication allowed, and is sshd reachable from the internet?
This site's view: do not leave a password door open
With password authentication off and keys only, this issue is listed by Alpine as not affecting you. A door left open for convenience is the door that gets used. Besides updating, review whether sshd is exposed and what accounts with an asterisk in the password field are used for. For prioritising, see How to prioritise vulnerabilities (CVSS, EPSS, KEV).
Timeline
November 5, 2026
OpenSSH releases Portable OpenSSH 10.6p2 with the workaround. Alpine Linux publishes an advisory and fixed packages. CVE-2026-123158 is published.November 6
NVD receives the record (no analysis of its own yet). Help Net Security reports a private threat-intelligence firm saw attack attempts less than nine hours after publication.November 7
This site checked the OpenSSH release notes, the CVE and NVD records, Alpine's advisory and KEV. Not listed in KEV.
Sources (public record)
Checked on November 7, 2026. Official sources come first.
- OpenSSH Release Notes, 10.6p2 (November 5, 2026) — openssh.org
- Alpine Linux, OpenSSH password authentication bypass (November 5, 2026) — alpinelinux.org / security tracker
- CVE-2026-123158 (published November 5, 2026) — cve.org / nvd.nist.gov
- CISA Known Exploited Vulnerabilities catalog (checked November 7; data updated November 4) — cisa.gov / JSON
- Press report (relays a private firm's statements; no independent verification found): Help Net Security (November 6, 2026) — helpnetsecurity.com
Update history
2026-11-07: First version, based on the OpenSSH 10.6p2 release notes, the CVE and NVD records and Alpine's advisory. As of November 7, not in KEV. Attack attempts reported by a private firm (unverified).
Read next
- SSH hygiene: SSH keys with least privilege
- Checking for intrusion: Checking a server for signs of intrusion
- After a disclosure: What to do when a vulnerability is published / How to prioritise vulnerabilities (CVSS, EPSS, KEV)
- Preparation: Security inventory checklist
- Glossary: What is a CVE?