---
id: "TECH-202611-2hlqfs"
kind: "technique"
aliases: []
title: "OpenSSH sshd lets attackers log in without the right password on Linux systems built with musl libc and PAM disabled, such as Alpine and Void Linux (fixed in OpenSSH 10.6p2, no CVE yet)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "OpenSSH", "fixed": ["10.6p2"], "vendor": "OpenBSD"}, {"name": "Alpine Linux", "fixed": [], "vendor": "Alpine"}, {"name": "Void Linux", "fixed": [], "vendor": "Void"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-05T12:32:53+00:00"
updated_at: "2026-11-05T12:34:01+00:00"
sources: [{"source": "analyst", "url": "https://www.openssh.org/releasenotes.html", "first_seen_at": "2026-11-05T12:32:53+00:00", "cites": ["https://www.openssh.org/releasenotes.html"]}]
exploit_sources: []
---

# OpenSSH sshd lets attackers log in without the right password on Linux systems built with musl libc and PAM disabled, such as Alpine and Void Linux (fixed in OpenSSH 10.6p2, no CVE yet)

OpenSSH released portable 10.6p2 on 2026-11-05 with what it calls a critical workaround for a password authentication bypass in sshd. It affects Linux systems where sshd is built and run with PAM support disabled on musl libc. The OpenSSH team says the root cause is outside sshd, but it can be exploited through sshd. Kevin Beaumont (GossiTheDog) says this probably means Alpine Linux (all versions) and Void Linux, and not Debian, Ubuntu, SUSE, Red Hat, CentOS or OpenWrt. That scope is his reading, not a statement from OpenSSH. Reported by Özgün Kültekin of Wakefield. No exploitation in the wild reported. CVE and distro package status unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :OpenSSH affected range not listed fixed 10.6p2
- :Alpine Linux affected range not listed fixed no fixed version listed
- :Void Linux affected range not listed fixed no fixed version listed

## How to check

- Find hosts and containers running sshd on musl libc: Alpine Linux (any version, including alpine-based Docker images that install openssh-server) and Void Linux musl.
- Check the version with `ssh -V` or `apk info openssh-server`. Anything before OpenSSH 10.6p2 is affected when PAM is disabled.
- Check whether sshd allows password logins: `sshd -T | grep -Ei 'passwordauthentication|usepam'`.
- Look in auth logs for successful password logins you cannot explain.
- The fix commit is openssh-portable 4353fdc43ef646c43a8dda7025cc1a898caf1482.

## Fix

- Upgrade to OpenSSH 10.6p2, or to your distro's patched openssh package once it is published (for Alpine: `apk upgrade openssh`).
- Until you have patched, set `PasswordAuthentication no` and `KbdInteractiveAuthentication no` in sshd_config, use key-only login, and restart sshd.
- Do not expose sshd to the internet on affected hosts.

## Timeline

- 2026-11-05T12:32:53+00:00 analyst https://www.openssh.org/releasenotes.html

## Documents

- [describes] Kevin Beaumont: OpenSSH has a vuln which allows logging in without a password. A thread. https:/ https://cyberplace.social/@GossiTheDog/117563742240898800
- [describes] Kevin Beaumont: This is the technical change to fix https:// github.com/openssh/openssh-por tabl https://cyberplace.social/@GossiTheDog/117563752022353496
- [describes] OpenSSH 10.6p2 release notes: sshd password authentication bypass on Linux with musl libc and PAM disabled https://www.openssh.org/releasenotes.html

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_