2026-11-07
OpenSSH 10.6p2 emergency fix (CVE-2026-123158): password-authentication bypass in sshd on musl systems without PAM, such as Alpine
On November 5, 2026 OpenSSH released 10.6p2 with a critical workaround for a password-authentication bypass in sshd on some Linux systems built and run with PAM disabled, notably those using musl libc. The CVE is CVE-2026-123158 (CVSS 3.1 base score 8.1, assigned by the CVE record's own scoring). Alpine Linux published an advisory the same day with fixed packages for every branch. Per Alpine, a host is affected when password authentication is on, an account has an asterisk in its password field, and another account has a regular hash. Setups with PAM enabled, with PasswordAuthentication no, or containers that do not run sshd are not affected. CISA's KEV did not list it as of November 7. A private threat-intelligence firm has reportedly seen attack attempts less than nine hours after publication, but no independent verification was found. This site's conclusion: check whether sshd runs on musl without PAM, update to 10.6p2 or your distribution's fixed package and restart sshd, turn off password authentication until then, and review authentication logs.