OpenSSH 10.6p2 fixes password bypass on some Linux systems: who is affected and what to do
OpenSSH released portable version 10.6p2 on November 5, 2026 with a critical workaround for a password authentication bypass affecting some Linux systems that use the musl C library with PAM disabled. Here is what the release notes say and how admins can check their exposure.
The OpenSSH project released Portable OpenSSH 10.6p2 on November 5, 2026, with what its release notes call "a critical security workaround" for a password authentication bypass in the sshd server. The bug affects some Linux systems that use the musl C library and run with PAM support disabled.
What happened?
According to the official release notes, sshd in earlier versions could be made to skip password authentication on some Linux systems "when built and run with PAM support disabled". The OpenSSH team says it considers the root cause "to be outside sshd", but because the bug "is exploitable via sshd", the project changed sshd to avoid it.
The issue was reported by Özgün Kültekin of Wakefield, the release notes say.
Who is affected?
Based on the release notes, the combination that matters is:
- a Linux system using the musl C library rather than the more common glibc, and
- OpenSSH's sshd built and run without PAM (Pluggable Authentication Modules).
musl is the C library used by lightweight distributions such as Alpine Linux, which is widely used as a base for container images. Systems using glibc, or with PAM enabled, are not described as affected by this specific fix.
What should administrators do?
1. Check whether you run sshd on musl-based systems. On many systems, `ldd $(command -v sshd)` shows which C library the binary links against.
2. Check whether PAM is in use. sshd's `UsePAM` setting and the way your package was built both matter.
3. Update to OpenSSH 10.6p2 or to your distribution's patched package as soon as it is available. Distributions often ship fixes under their own package version numbers.
4. Review exposure. Where possible, limit SSH to trusted networks and prefer key-based authentication with strong controls.
This is general security guidance. Follow your distribution's own advisory for exact package versions.
Why are OpenSSH releases more frequent now?
Recent OpenSSH release notes say the team has received "a large number of security bug reports", many found by AI models or with AI help. They note that bugs found by AI tools are sometimes rediscovered independently by others, suggesting that attackers can find them too. As a result, the project says it will make more frequent releases rather than batching fixes until the next planned release. Version 10.6p1 shipped on October 6, 2026, just a month before 10.6p2.
Other changes in 10.6p2
The release also enables the post-quantum hybrid signature scheme `ssh-mldsa44-ed25519` as an allowed certificate authority signature algorithm. It fixes a brief CPU spin when `ChannelTimeout` is used, along with several portability fixes.
Sources
- OpenSSH release notes, 10.6p2 (Nov 5, 2026): https://www.openssh.com/releasenotes.html
Image: Photo: Derrick Coetzee / Wikimedia Commons, CC0 public domain dedication (https://commons.wikimedia.org/wiki/File:Rear_of_rack_at_NERSC_data_center_-_closeup.jpg) — file photo
About this article: prepared by The Daily Context editorial desk using automated, source-based reporting from the publications linked above. No reporter was on the ground.