NewsCompaniesFlawsGuides
Get the app

OpenSSH update blocks a login bypass on some musl Linux servers; Alpine packages available

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.
openssh.org: OpenSSH: Release Notes
Screenshot: openssh.org

OpenSSH released portable version 10.6p2 on 5 November with a workaround for a password-login bypass on some musl-based Linux servers running without PAM authentication. The flaw, CVE-2026-123158, affects particular account configurations when SSH password logins remain enabled. Alpine has released patched packages and says administrators must restart the SSH service after updating.

Some Alpine and other musl Linux servers can admit outsiders to accounts meant to reject passwords. Ask IT to apply the update, restart SSH and check how those servers accept logins.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

If your business or family office runs Alpine Linux servers, ask IT to check them today. OpenSSH released portable version 10.6p2 on 5 November with a workaround for a password-login bypass affecting some Linux systems that use musl, a software library underneath the operating system. OpenSSH describes the security workaround as critical.[1]

The flaw, CVE-2026-123158[2], can allow unauthorised access under particular account configurations. The immediate job is to establish which servers are exposed and close that route in.

OpenSSH musl login bypassCVE-2026-123158
HARD priority
High Ask IT to act today
Upstream workaround
Portable OpenSSH 10.6p2
Alpine 3.24 package
10.3_p1-r2
Alpine 3.23 package
10.2_p1-r1
Alpine 3.22 package
10.0_p1-r11
Alpine edge package
10.6_p2-r0
Patched versions differ by branch. Package versions from Alpine’s advisory[3]; upstream release from OpenSSH.

Timeline

  1. HARD publishes its article, at High.

Who is affected

The affected combination is OpenSSH on musl-based Linux, running without PAM, a separate authentication system, while SSH password logins are enabled. Alpine also specifies two account conditions: an account marked with an asterisk instead of a password hash, and another local account with a SHA-256 or SHA-512 password hash. The asterisk can mark an account intended to accept only SSH keys.

Using a key for your own login does not establish that the server rejects passwords. Ask IT to check the server’s settings. musl maintainer Rich Felker confirms that the exposed configuration has PAM disabled and password authentication enabled. His advice is to disable password authentication if an immediate upgrade is impossible.[4]

What the update changes

OpenSSH calls its change a workaround and says it considers the underlying fault to be outside its server software. Felker takes a different view: he says the problem is incorrect use of musl by the calling software. Both recommend the same immediate protection for affected OpenSSH systems: update, or disable password logins.

Alpine has included the protection in older OpenSSH versions, so a version number below 10.6p2 does not necessarily mean the server is unpatched. Its 5 November releases[5] include the update. Alpine explicitly tells administrators to update and restart the SSH service.

What to do today

  1. Ask IT for a server check.Ask whether any business or family-office servers run OpenSSH on musl-based Linux without PAM, with password logins enabled. Have IT check the account conditions in Alpine’s advisory.
  2. Install the appropriate update and restart SSH.Ask for confirmation of the installed package version and the service restart. Use the distribution’s patched package where available; the box above lists versions for Alpine 3.22–3.24 and edge.
  3. If updating must wait, disable password logins.Have IT confirm that SSH key access works first, set PasswordAuthentication no and restart SSH. Keep the existing administration session open until a fresh key login has been tested.
  4. Check exposed servers for unexpected access.Alpine recommends looking for successful password logins to accounts that have no password, and reviewing new users and authorised keys. If an unauthorised login cannot be ruled out, Alpine says to treat the machine as compromised.
  • CVE-2026-123158 Not on CISA’s list of flaws being used in attacks. Look it up in Search.
  • Linux every Linux flaw being used in attacks

References

  1. ^ OpenSSH (). “OpenSSH 10.6p2 release notes”. Release date, critical workaround, affected musl/PAM configuration and OpenSSH’s position on the root cause.
  2. ^ CVE Program / MITRE (). “CVE-2026-123158 official record”. Confirms the published identifier, conditional authentication bypass and upstream affected-version boundary.
  3. ^ Alpine Linux (). “Security advisory: openssh-server password authentication bypass”. Account prerequisites, patched package versions, restart requirement, mitigation and investigation guidance; read through indexed page content.
  4. ^ Rich Felker / musl mailing list (). “Advisory for OpenSSH+musl users”. Confirms configuration prerequisites, safe mitigation sequence and musl maintainer’s disagreement about the root cause; read through indexed content.
  5. ^ Alpine Linux (). “Alpine 3.21.10, 3.22.8, 3.23.8 and 3.24.4 released”. Confirms releases containing the protection and the instruction to update and restart SSH; read through indexed content.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.