TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
The OpenSSH team released Portable OpenSSH 10.6p2 on November 5, 2026, with a workaround for a password-authentication bypass affecting some Linux systems when PAM is disabled. The release notes say the issue is exploitable through sshd but place its root cause outside sshd; the precise affected configurations and vulnerability details are not provided.
OpenSSH 10.6p2, released November 5, includes a security workaround for a password-authentication bypass affecting some Linux systems built and run with PAM support disabled. The OpenSSH team says the issue can be exploited through sshd, although it considers the underlying cause to be outside the SSH server itself.
The release notes describe the change as a critical security workaround and say it applies to Linux systems using musl libc with PAM disabled. Alpine Linux commonly uses musl, which makes the release particularly relevant to administrators running Alpine-based SSH servers without PAM. The notes do not say that every Alpine system is affected: the stated condition is a particular combination of platform and build configuration.
The project identifies the flaw as an authentication bypass and says it is exploitable via sshd. It does not publish a CVE identifier, severity score, exploitation details, or a list of affected distributions and versions in the supplied release text. OpenSSH credits the report to Özgün Kültekin of Wakefield. The release notes characterize the root cause as outside sshd, while saying sshd can avoid the issue.
Version 10.6p2 also includes fixes already committed to the portable OpenSSH 10.6 stable branch. These include enabling the ssh-mldsa44-ed25519 hybrid signature scheme as an allowed certificate-authority signature algorithm, and fixing a less-than-one-second CPU spin when ChannelTimeout was in use. Portability changes address older systems, locale detection, agent socket creation, interrupted passphrase reads, and the sshd seccomp sandbox.
Checking Alpine SSH Configurations
The risk is most direct for operators whose SSH servers match the release’s stated conditions: Linux using musl, with PAM disabled, and an affected sshd configuration. A password-authentication bypass could undermine a server’s access controls, so administrators should establish whether their build falls within that scope and apply the vendor’s available update or mitigation guidance. The release title’s reference to Alpine points toward a practical concern for Alpine users, but the release notes do not declare all Alpine installations vulnerable.
The distinction between a workaround in sshd and a root cause outside it matters for remediation. Updating to 10.6p2 is the OpenSSH project’s delivered change, but other components or build choices may also be relevant. Operators should not infer from the release alone that a system is safe simply because it uses Alpine, nor that it is affected solely because it uses musl. The stated condition includes disabled PAM, and the project has not supplied a complete configuration matrix in the available text.
The release also has broader operational importance. The team says it plans more frequent releases after receiving numerous security reports, including findings from AI tools and reports later found independently by other researchers. Faster releases can put fixes in users’ hands sooner, while requiring maintainers to review updates more promptly.
Products Worth Considering
DJI Mic 2 Wireless Microphone System (2 Transmitters, Receiver, Charging Case)
DJI Osmo Mobile 7P Smartphone Gimbal Stabilizer with Mic Mini Transmitter
Apple iPad mini (A17 Pro), 128GB, Wi-Fi 6E, Space Gray
As an affiliate, we earn on qualifying purchases.
Why Version 10.6p2 Was Issued
OpenSSH 10.6 and 10.6p1 were released on October 6, 2026; 10.6p2 followed on November 5. In the 10.6 release notes, the project discussed an increase in incoming security reports, including AI-assisted findings. It said many reports did not amount to security problems under a realistic threat model, but welcomed reports supported by human analysis, tests, and proposed fixes.
The team also said that some issues identified with AI tools were later independently discovered by other researchers. It argued that this could mean adversaries may find similar flaws even when they do not report them. In response, it said it would make releases more frequently rather than hold fixes for a later planned version. The 10.6p2 security workaround is one example of a follow-up release between scheduled versions.
Portable OpenSSH provides SSH client and server software across systems beyond OpenBSD. The 10.6p2 announcement says the source release is available through the project’s mirrors and provides a SHA-256 checksum for the source archive. Its separate deprecation notices concern future behavior of scp’s remote-to-remote -R option and support for some older platforms; those notices are not the security workaround addressed in this report.
“This release contains a critical security workaround that affects Linux systems that use the musl libc and PAM disabled.”
— OpenSSH release notes for 10.6p2
Scope and Exploit Details
The supplied release notes do not identify a CVE number, provide a technical account of how the bypass works, or state whether exploitation has been observed in the wild. They also do not list the exact affected Linux distributions, package versions, build flags beyond PAM being disabled, or any conditions required for an attack.
Although the announcement specifically mentions musl libc and the title highlights Alpine without PAM, the project does not say that all Alpine systems are affected. It is also not clear from the text whether systems with PAM enabled, systems using another C library, or particular downstream-patched packages are affected. Those points require confirmation from OpenSSH or the relevant distribution maintainers.
Verify Builds and Apply Updates
Administrators should check whether their OpenSSH server is built and run with musl libc and PAM disabled, then consult the OpenSSH release information and their distribution’s security advisories for package availability and configuration-specific instructions. Where applicable, they should move to a package containing the 10.6p2 workaround or follow a distributor-provided mitigation. The release notes provide the source archive checksum and point users to the project’s mirrors.
Further guidance from OpenSSH or distribution maintainers may clarify the affected configurations and remediation for packages that do not yet provide 10.6p2. The project’s release notes also direct security bug reports to its security contact. Until additional technical details are published, administrators should treat the stated platform conditions as a reason to verify exposure, not as proof that every matching installation has been exploited.
Key Questions
What does OpenSSH 10.6p2 fix?
It adds a security workaround for a password-authentication bypass that the project says affects some Linux systems built and run with PAM disabled. The notes specifically mention musl libc.
Does this affect every Alpine Linux system?
The release notes do not say that every Alpine installation is affected. They describe systems using musl libc with PAM disabled; Alpine operators should check their server’s build and configuration and consult distribution advisories.
Is the issue being exploited in the wild?
The supplied OpenSSH announcement does not say whether exploitation has been observed. It provides no public exploitation details or CVE identifier.
What should administrators do?
Check whether the server matches the stated conditions and update to a package containing OpenSSH 10.6p2 or follow guidance from the relevant Linux distribution. The release text does not provide a complete list of affected configurations.
What else is included in 10.6p2?
The update includes several fixes, including support for the ssh-mldsa44-ed25519 certificate-authority signature algorithm and a CPU-spin fix related to ChannelTimeout, as well as portability corrections.
Source: openssh.org
