OpenSSH Releases Fix for Critical Password Bypass on musl Linux Systems Without PAM

OpenSSH released version 10.6p2 with a workaround for a critical password-authentication bypass affecting Linux systems that use musl libc without PAM for password authentication, including affected Alpine Linux installations. Attackers could reportedly gain access without knowing the password. OpenSSH developer Damien Miller said non-Linux systems, Linux systems using glibc, and Linux systems using PAM for password authentication are not affected. The developers believe the root cause lies outside OpenSSH itself.

Affected administrators should immediately disable SSH password authentication and restart sshd, or temporarily disable SSH entirely, until they can install the update. Alpine Linux made an updated package available, although heise reported that other distributions and many OpenSSH download servers were still serving 10.6p1 at publication. Miller credited Özgün Kültekin of Wakefield with reporting the issue and said the team released the mitigation within roughly a day of learning about it, citing observed rapid rediscovery of vulnerabilities by AI agents as a reason to avoid lengthy embargoes.