OpenSSH CVE-2026-123158: Patch the musl Password-Authentication Bypass Now

OpenSSH and Alpine Linux have fixed a critical SSH password-authentication bypass that requires musl libc, PAM-disabled authentication, password logins, and specific account states.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

A glowing cyan shield with a key and terminal symbol blocks an amber network path inside a generic server room.
AI-generated editorial illustration of SSH access protection; not official OpenSSH or Alpine Linux artwork.

CRITICAL SECURITY ADVISORY · FIX AVAILABLE

The decision: patch affected musl/Linux SSH servers and restart sshd

Portable OpenSSH 10.6p2 fixes a password-authentication bypass affecting some Linux systems that use musl libc with PAM disabled. [1]

Reporting cutoff: November 5, 2026, 3:48 PM EST (2026-11-05T20:48:30Z).

This is not an all-Linux or all-OpenSSH emergency. Alpine says exploitation requires password authentication to be enabled, a non-PAM OpenSSH path, an account whose password field is *, and at least one local account with a $5$ or $6$ password hash. [2]

Tracked as CVE-2026-123158. [3]
Upstream fix Portable OpenSSH 10.6p2, released November 5, 2026. [1]
Immediate action Update the applicable vendor package and restart the running SSH daemon. [2]

Who is exposed

On Alpine Linux, the confirmed exposure predicate is: the default non-PAM openssh-server package, or openssh-server-pam with UsePAM no; PasswordAuthentication yes; an account with * in its password field; and at least one local account with a $5$ or $6$ hash. [2]

Alpine explicitly excludes containers that do not run sshd, systems with password authentication disabled, PAM-enabled password checks, accounts locked with !, and systems with no dollar-prefixed password hash. [2]

Fixed Alpine packages

Alpine published branch-specific packages back to release 3.16; these downstream package versions may retain older upstream version numbers because the fix is backported. [2]

Alpine branch Fixed OpenSSH package
edge 10.6_p2-r0
3.24 10.3_p1-r2
3.23 10.2_p1-r1
3.22 10.0_p1-r11
3.21 9.9_p2-r1
3.20 9.7_p1-r6
3.19 9.6_p1-r3
3.18 9.3_p2-r4
3.17 9.1_p1-r7
3.16 9.0_p1-r6 [2]

Practical response sequence

  1. Inventory exposed SSH services. Confirm the operating system and package origin, whether musl is in use, whether PAM handles password checks, and the effective PasswordAuthentication setting. [2]
  2. Apply the correct vendor package and restart sshd. Alpine warns that package installation alone does not replace the running daemon. [2]
  3. If patching must wait, first prove key access in a separate session, keep the current session open, disable password authentication, validate the configuration, restart the daemon, and confirm the effective setting. [2]
  4. Review authentication evidence. Alpine advises checking for accepted password logins to accounts that have no password and reviewing privilege use, new users, files, and authorized keys; if a login cannot be ruled out, treat the machine as compromised. [2]
  5. Verify the outcome. Confirm the fixed package is active, the intended effective SSH configuration is loaded, and no stale daemon remains from before the restart. [2]

Uncertainty: The primary sources reviewed at the cutoff establish the vulnerability, affected conditions, and fixes, but they do not establish that every musl-based distribution has shipped a fix or that any Treasure Coast organization or The IT Guys customer was affected. [1][2]

Sources

  1. OpenSSH 10.6p2 release notes — released November 5, 2026; retrieved 2026-11-05T20:48:30Z.
  2. Alpine Linux security advisory: openssh-server password authentication bypass — published November 5, 2026; retrieved 2026-11-05T20:48:30Z.
  3. CVE Record: CVE-2026-123158 — retrieved 2026-11-05T20:48:30Z.

Browse Articles

Latest Articles