Update, Nov. 6: The flaw has been assigned the identifier CVE-2026-123158 and a severity score of 8.1 out of 10. France's national cybersecurity agency issued a formal alert saying exploitation is trivial on affected setups. No attacks using the flaw have been reported.
OpenSSH, the widely used remote-login software for Linux and Unix systems, released version 10.6p2 Thursday with what its release notes call a critical security workaround for a flaw that can let attackers log in without the right password, LWN and the OpenBSD Journal reported. Only certain Linux systems are affected, including Alpine Linux, a small distribution widely used for containers, cloud servers and embedded devices, so security teams need to find those machines quickly.
What Happened
The flaw affects Linux systems built on musl, a lightweight version of the C standard library that programs rely on for basic functions, when PAM is switched off. PAM, short for Pluggable Authentication Modules, is the Linux framework that usually handles password checks. OpenSSH developer Damien Miller said, as quoted by LWN and the OpenBSD Journal, that the problem does not exist on non-Linux systems, on Linux systems using the more common glibc library, or on Linux systems that use PAM for password logins. OpenBSD, where OpenSSH is developed, is not affected.
The project says the root cause lies outside OpenSSH itself but that the bug can be exploited through, and blocked in, its server program. The release notes list no CVE identifier, the standard tracking number for vulnerabilities, and no severity score. The report is credited to Özgün Kültekin of Wakefield, which heise describes as an AI security company. Heise reported that the OpenSSH team learned of the issue the day before the release.
On his own disclosure page, Kültekin says a very long password can open accounts that were meant to accept only cryptographic keys, including, he says, the default user on Alpine's official cloud images, which can gain administrator rights; those claims have not been independently confirmed.
Why It Matters
Miller urged operators of affected systems to turn off password logins or shut down SSH on those machines immediately. Alpine sits inside many container images, network appliances and cloud templates that never get a close look, so the exposure may be larger than an organization's server inventory suggests.
According to heise, Alpine's updated package was already available while other distributions and many OpenSSH download mirrors were still offering the previous version. LWN reported that Alpine plans to backport the fix as far as Alpine 3.16, released in May 2022. Heise also reported that the developers fear attackers could find the bug quickly with AI help.
The Primary Wire reported in October, citing Help Net Security, that the project had promised faster releases as AI tools surface more bugs. This fix arrived a month after 10.6 itself.
What to Watch
- How quickly scanning tools flag affected hosts now that a CVE and severity score are published.
- Alpine package updates for older branches, and fixes from other musl-based systems and appliance makers.
- Any reports of the bypass being exploited, or a listing in the U.S. Cybersecurity and Infrastructure Security Agency's catalog of known exploited vulnerabilities.
