OpenSSH Fixes a Flaw That Let Attackers Skip the Password

The OpenSSH project released OpenSSH 10.6p2 on Nov. 5, 2026, closing a flaw that let an attacker log in to some Linux servers without knowing a password. Its release notes say the flaw is reachable through sshd, the SSH server program, on machines built against the musl C library with PAM support switched off. PAM is the Linux component that would otherwise check the password.

Alpine Linux, whose default openssh-server package is built without PAM, published its own advisory the same day, telling anyone who runs sshd to update openssh and then restart it, because upgrading the package does not replace the server that is already running. Alpine says anyone who cannot update yet should turn password logins off instead, which closes the hole as well.

The advisory says the bug is in every release Alpine checked, from 3.24 down to 3.16, including ones that no longer get regular updates, and that Alpine has published fixed packages for all of them. Not affected: systems that already refuse password logins, installations using Alpine's PAM-enabled package with PAM in use, and containers that do not run an SSH server at all.

The release notes describe the version as carrying "a critical security workaround that affects Linux systems that use the musl libc and PAM disabled," and credit the report to Özgün Kültekin of Wakefield. The CVE Program's record lists the flaw as CVE-2026-123158 and rates it high, at 8.1 on the CVSS severity scale.

The same release notes also record a change in how the project ships fixes: the OpenSSH team says it has received a large number of security bug reports, many of them findings from AI models or made with AI assistance, and that it will for now release more often rather than hold fixes until the next planned version. Its stated reason is that bugs found with AI tools have in several cases been found independently by another researcher, which the team reads as a sign that attackers can find them too.