OpenSSH 10.6p2 fixes a login bypass on musl Linux

A fix for a specific server configuration

OpenSSH released Portable OpenSSH 10.6p2 on 5 November 2026 with a critical workaround for a password-authentication bypass affecting some Linux servers. The developers identify systems using musl libc with PAM disabled. They place the underlying cause outside sshd, while explaining that an attacker can exploit it through that service and that OpenSSH can block the path.

Özgün Kültekin of Wakefield reported the issue. The research disclosure places the vulnerable behaviour in OpenSSH releases from 7.3p1 onward. An older version number alone does not establish exposure: the C library, authentication path and local accounts also matter. Distribution packages may incorporate the fix without adopting the latest upstream version number. [1]

The conditions that must coincide

Wakefield says all of these conditions must be present: the server uses musl; OpenSSH runs without PAM; SSH password authentication is enabled; one account’s password field contains exactly an asterisk (*); and another account has a real SHA-256 or SHA-512 password hash. The flaw can allow a password login to the account whose password field contains the asterisk, despite that field being intended to prevent such authentication.

Alpine’s standard openssh-server package is an important configuration to check. Wakefield distinguishes it from openssh-server-pam with UsePAM yes. Other musl-based installations require the same configuration checks. According to the researcher, glibc-based systems, OpenSSH using PAM, Dropbear, OpenBSD, FreeBSD and macOS are outside this flaw’s affected scope. A distribution name or an open SSH port is therefore insufficient to classify a host. [2]

Updating and checking past access

Install OpenSSH 10.6p2 or a distribution package containing the correction. Confirm the package advisory for the actual release branch before deciding whether an installed build is fixed. CERT-FR recommends disabling password authentication, or the service if necessary, when applying the patch is impossible. Administrators should first ensure that an alternative authorised access method works, to avoid locking themselves out.

CERT-FR also recommends investigating password-logins recorded for accounts whose password field is an asterisk. Such entries warrant investigation rather than an automatic conclusion about the attacker or the extent of access. The documents reviewed for this article do not establish a count of compromised servers or confirm compromise of a particular reader’s system.

In its 6 November update, CERT-FR identifies the issue as CVE-2026-123158. Alpine lists fixed packages for branches 3.24 (10.3_p1-r2), 3.23 (10.2_p1-r1) and 3.22 (10.0_p1-r11), with other branches detailed in its advisory. Restart sshd after updating or changing authentication settings: installing a package alone does not replace the running daemon. [3][4]