OpenSSH 10.6p2 patches auth bypass on Alpine Linux
Original: OpenSSH 10.6p2 Critical workaround for alpine without PAM
Why This Matters
Auth bypass in widely deployed sshd affects every PAM-less Alpine container.
OpenSSH 10.6p2 released 2026-11-05 fixes a critical password authentication bypass in sshd on Linux systems using musl libc with PAM disabled, reported by Özgün Kültekin of Wakefield.
OpenSSH 10.6p2 dropped on November 5, 2026, as an out-of-cycle release targeting a critical security issue: a password authentication bypass exploitable through sshd on Linux systems built without PAM support — most notably Alpine Linux, which uses musl libc. The OpenSSH team notes the root cause lies outside sshd itself, but the vector is exploitable through it and can be mitigated there. The bug was reported by Özgün Kültekin of Wakefield (wakefield.co).
Beyond the security fix, the release enables the post-quantum hybrid signature scheme ssh-mldsa44-ed25519 as an allowed CA signature algorithm, and patches a sub-second CPU spin triggered when ChannelTimeout was configured. Portability fixes address compilation on older platforms, Azerbaijani locale detection, agent socket creation on systems without openat(2), and SIGINT/SIGQUIT passphrase-reading edge cases.
Notably, the team flagged that AI-assisted security research is now a material part of its threat model. In several cases, AI tools independently identified the same bugs as human researchers — a signal, the team says, that adversaries without disclosure ethics can likely find them too. OpenSSH will increase release cadence to push fixes out faster rather than batching them.