Threat Intel·General CTI·Nov 5, 2026·ByBulwark Copper

OpenSSH on musl: Patch the Server, Verify Key-Only Accounts Stay Key-Only

OpenSSH 10.6p2 addresses a conditional musl/no-PAM password bypass. Check key-only account enforcement, deploy fixed packages and investigate unexpected logins.

Conceptual illustration of a closed metal sluice gate in an alpine stone waterworks, with water flowing through a separate channel beside it, misty mountains and crimson autumn leaves.

Portable OpenSSH 10.6p2, released November 5, addresses a critical password-authentication bypass affecting some Linux systems that use musl libc with PAM disabled. The practical risk is not that every SSH password can be bypassed. It is that certain accounts administrators intended to keep inaccessible by password can accept a password login under a specific combination of server settings and account state.

For small businesses and government contractors running Alpine-based cloud hosts, appliances or custom Linux images, the immediate task is to identify the actual SSH server and authentication configuration—not assume that a key-only operating practice means password authentication is disabled on the server.

What the sources establish

OpenSSH's release notes describe 10.6p2 as a critical security workaround for musl Linux systems with PAM disabled. The project considers the root cause to be outside sshd, while confirming that the bypass is exploitable through sshd and can be avoided there.

Researcher Özgün Kültekin of Wakefield explains that musl's password-hashing error return can match the single asterisk stored in an account's password field. In the affected authentication path, a hashing failure can therefore be mistaken for a successful password comparison. The researcher traces the interaction to older changes, including a 2016 OpenSSH timing-defense change. November 5 is the current disclosure and fixed-release date, not evidence that attacks began today.

Check the conditions together

The researcher's affected-system checklist requires all of the following:

OpenSSH's server runs on a musl-based Linux system.
PAM authentication is not being used.
SSH password authentication remains enabled.
A target account has exactly a single asterisk as its stored password field.
Another account has a real password hash.

A valid password hash is not the same as the asterisk sentinel involved here. Likewise, a user who normally authenticates with a key is not necessarily protected if the server still offers password authentication and the account meets the vulnerable conditions.

Kültekin identifies Alpine Linux, OpenWrt, Buildroot and Yocto as environments to check, not as proof that every deployment is vulnerable. The researcher says the default alpine user in Alpine's official AWS and Azure images has passwordless doas privileges, making a successful login potentially a route to root when the other required conditions are present. That is a conditional impact statement, not evidence that every fresh cloud instance is exposed.

The researcher identifies glibc-based systems and PAM authentication paths as unaffected by this particular attack. An Alpine-based container without an SSH server is not an exposed SSH endpoint merely because its base image uses musl.

Actions for lean infrastructure teams

Inventory the serving process. Identify hosts, management interfaces and custom images actually running OpenSSH sshd. Record the libc, PAM use, effective password-authentication policy and relevant account state. Review cloud images and appliance builds separately from mainstream workstation Linux.
Close the unnecessary password path. Where keys are the intended access method, the researcher recommends PasswordAuthentication no. Validate the effective configuration, including applicable overrides, before restarting or reloading the service. Keep a tested recovery or console path so an emergency change does not lock out administrators.
Deploy a documented fix. OpenSSH confirms the workaround in Portable 10.6p2. The researcher recommends apk upgrade openssh on Alpine. Verify that your distribution or image supplier's installed package actually includes the fix; a completed package command alone is not confirmation, and upstream version labels may differ from vendor backports. Replace vulnerable templates as well as running instances.
Investigate successful password logins. Compare SSH authentication records with accounts that should not have accepted passwords. Preserve historical logs and account/configuration evidence before making destructive changes. An unexpected successful password login deserves investigation; current account state alone does not prove what its state was at login time.
Respond to the authority gained. If unauthorized access is established, investigate commands, privilege escalation, persistence and reachable secrets. Recover affected credentials and trusted deployment paths from a clean administrative environment. Patching the bypass stops that entry path; it does not establish that an earlier session was harmless.

Evidence limits

The reviewed researcher report and OpenSSH release notice do not establish confirmed exploitation in the wild, a campaign actor, victim counts or country attribution. They also do not provide a complete distribution-by-distribution affected-version matrix. The older CVE-2016-6210 discussed in the technical history concerns username enumeration; it should not be presented as an identifier for this newly disclosed bypass.

Bulwark assessment

This is an urgent configuration-and-patching problem for the affected subset, not a reason to characterize all Linux SSH services as compromised. The durable lesson is to make an intended access boundary explicit: if an account is meant to be key-only, verify that the server really refuses password authentication for it. Pair that control with vendor-fixed software, off-host logs and review of the privilege behind the account.

Primary source: OpenSSH release notes, including Portable OpenSSH 10.6p2 dated November 5, 2026.

Primary source: Özgün Kültekin's original musl/OpenSSH authentication-bypass research and mitigation guidance.

Secondary context: BleepingComputer's November 5 report.

Extracted Observables

246 observables, auto-extracted and defanged.

Analysis artifacts

TXT CSV JSON

Choose a file to view it here. Values are live, not defanged.

IPv4 (1)

1[.]2[.]3[.]4

IPv6 (1)

3ffe:ffff::

Domains (29)

arxiv[.]orgbugzilla[.]mindrot[.]orgcdn[.]openbsd[.]orgconfig[.]h[.]inconfigure[.]accrypto[.]stanford[.]educss[.]csail[.]mit[.]educvs[.]openbsd[.]orgcvsweb[.]openbsd[.]orgeprint[.]iacr[.]orghterm[.]orghxxps[.]openbsd[.]orgmakefile[.]inmakefile[.]incmechanism[.]cwopenssh[.]comopenwall[.]comsparrow[.]ece[.]cmu[.]edussh[.]comtwistedmatrix[.]comviolet[.]ibs[.]com[.]auwakefield[.]cowww[.]aet[.]tu-cottbus[.]dewww[.]citi[.]umich[.]eduwww[.]core-sdi[.]comwww[.]openbsd[.]orgwww[.]opensc[.]orgwww[.]openssh[.]comwww[.]openssl[.]org

URLs (46)

hxxp://bugzilla[.]mindrot[.]orghxxp://bugzilla[.]mindrot[.]org/hxxp://crypto[.]stanford[.]edu/~dabo/papers/ssl-timing[.]pdfhxxp://css[.]csail[.]mit[.]edu/stack/hxxp://hxxps[.]openbsd[.]org/cgi-bin/orderhxxp://hxxps[.]openbsd[.]org/cgi-bin/order[.]euhxxp://openwall[.]com/advisories/OW-003-ssh-traffic-analysis[.]txthxxp://sparrow[.]ece[.]cmu[.]edu/~adrian/projects/validation/validation[.]pdfhxxp://violet[.]ibs[.]com[.]au/openssh/files/ChangeLoghxxp://violet[.]ibs[.]com[.]au/openssh/files/MIRRORS[.]htmlhxxp://www[.]aet[.]tu-cottbus[.]de/personen/jaenicke/postfix_tls/prngd[.]htmlhxxp://www[.]citi[.]umich[.]edu/projects/smartcard/hxxp://www[.]citi[.]umich[.]edu/u/provos/ssh/privsep[.]htmlhxxp://www[.]core-sdi[.]com/advisories/ssh1_sessionkey_recovery[.]htmhxxp://www[.]openbsd[.]org/orders[.]htmlhxxp://www[.]openbsd[.]org/tshirts[.]htmlhxxp://www[.]openbsd[.]org/tshirts[.]html#18hxxp://www[.]openssh[.]com/hxxp://www[.]openssh[.]com/donations[.]htmlhxxp://www[.]openssh[.]com/legacy[.]htmlhxxp://www[.]openssh[.]com/list[.]htmlhxxp://www[.]openssh[.]com/portable[.]htmlhxxp://www[.]openssh[.]com/portable[.]html)inhxxp://www[.]openssh[.]com/report[.]htmlhxxp://www[.]openssh[.]com/txt/gcmrekey[.]advhxxp://www[.]openssh[.]com/txt/legacy-cert[.]advhxxp://www[.]openssh[.]com/txt/portable-keysign-rand-helper[.]advhxxp://www[.]openssh[.]com/txt/release-3[.]8[.]1p1hxxp://www[.]openssh[.]com/txt/x11fwd[.]advhxxp://www[.]openssh[.]com/usage[.]htmlhxxp://www[.]openssl[.]org/hxxps://arxiv[.]org/abs/2609[.]07709hxxps://cdn[.]openbsd[.]org/pub/OpenBSD/OpenSSH/RELEASE_KEY[.]aschxxps://cvsweb[.]openbsd[.]org/log/src/usr[.]bin/ssh/readconf[.]c,v#rev1[.]284hxxps://eprint[.]iacr[.]org/2020/014[.]pdfhxxps://hterm[.]orghxxps://hxxps[.]openbsd[.]org/cgi-bin/orderhxxps://hxxps[.]openbsd[.]org/cgi-bin/order[.]euhxxps://openssh[.]com/pq[.]htmlhxxps://twistedmatrix[.]com/trac/ticket/9422hxxps://www[.]openbsd[.]org/errata[.]htmlhxxps://www[.]openssh[.]com/hxxps://www[.]openssh[.]com/[.]Thishxxps://www[.]openssh[.]com/agent-restrict[.]htmlhxxps://www[.]openssh[.]com/donations[.]htmlhxxps://www[.]openssh[.]com/report[.]html

md5 (19)

1dbfd40ae683f822ae917eebf171ca423d2f1644d6a3d3267e5e2421f138512942bd78508d208b55843c84dd54dea84861cf5b059938718308836d00f6764a9472ef1134d521cb6926c99256dad17fe0758822b888c5c3f83a98045aef90425477662801ba2a9cadc0ac10054bc6cb377861a4c0841ab69a6eec5c747daff6fb79fc225dbe0fe71ebb6910f449101d237b36f28fc16e1b7f4ba3c1dca191ac927d5590a333d8f8aa1fa6f19e249387007dbf15fe7c294672e8822127f50107d086864ecc276c5f75b06d4872a553fa708e1774d0b52aff08f817f3987442a16e93f48bfcc1560895ae53de6bfc41689baa2acd2be17dc3fd514a1e09336aab51d4c2c88b883f097fe88e327cbb4b2e2af3879270bffe479e1bd057aa36258696f54e574e606c08ef63ebb1ab2f7689dc

sha1 (139)

04c7adb9986f16746588db8988b910530c58981904cae43c389fb411227c01219e4eb46e3113f34e05302aa4781e1a69db4261474ed940bd685afc2406c1db39f33831fe004726e013b2cf84f188904206dd658874dcd22d66311cf5999bd56c614de509080acf6ff0b862e8faa3baa3920a079536d28e85096e9cd60cd08e0acacfe16b615144f8c0463da50a375e20d895670489a9241f8faa57670214fbed0cb66e56805d66b51511455423bab88aa58a14550daae2a8c47c489a8784f2c38c4b39e6159ba678121cea3a730c0b0353334b6f46f438de30ab492814e5fbed710ade334d65925e080d1aaeb9c85bf615545440268967511d3194ebf20bcd0c7ff3fcc9157fe3989a245c58fcdb34d9fe722a3c4e14c008163272058edc20a8fde81661734a6684c9b4db111776832d902f7b4c7863afd41a5ec7a14efe95d61e2073f95d5ead8f2814b4b6c0700bcd533c410f1e5b43844ed015e4fbbbe25cfad6f5377c60e7591eb964897a4372f6fb96c7effeb509ec71c379c9205cdf0040a238047e2c49f43460e03d76e5d650205dece2c8b41c69b082eb65320d359987aae25b219cf700c317f400bb20b001c0406056f7188ea42294b5e5a591420aa05ff607c1890ab622ace8782330bbf82ed08cf3ac70e0acf00186ef3eeb97e024812e05fa233014c847c7775748316e7f8a836c260074ed466e95f054ac05a4406f613d08575217273163972f623bb9bffef9fd75a85c74d3b2263327e267e370315561de96577fccae563bc2c37a602a3042372f08afb1415ceaec8178213276a363022b5b0751fd578283ba7b106025c0ba391fd72f1f2eefcbbeb9e4fa16fa4500dec107d1a09d3d02d73067e2af7c526b31c7e94bc3ed38904ef791eb2c315497b27a0186e4aef67987cfc9f3d9ba561cd83363a72b4fee91b29cf2024ff633c17f6cd2f86d347dd39c91c3529f41dae63714d452fb95efea1e35c16dcc6e7d0a9465faa241476ef24f76b196cc361c6335e74809b26ea096b34062ba8ff6c97cd63ae2d6a3a695d92778c4c4567dcd6ad481092f6c3b172b8e971773a7018bbf3231f6589ae539ca4b423e27475f06e1055847dfff7f61e1ac632b5372446fe9ed171f289f0d62197dffdbfdaaf21c49f246c63b7ddbe46a0666222f7988c993866c31fcca4caf1a50eb3a3da821c16298c4aaa576fe24210c58357db9e64ba6382bef3d73d1d386fcdc0508f459864a048b09ad1b6e65a74d5d385d8189ab8c745d30aba0423c44e89924bb44c5d2153635506a9f5dea1f3c88f9cfe53a711a3c893ee8b7d3ffecff5ded7eb0add0b02b5d1a1c4bf5cb2c89d2117b535e7231cfa8ec673ea856ce291b78fac8b380eb785e8f185d00afb4f4f89801e9b0f8b9cee9d87ebd5f9d2f73ddfe94f3f0a78bdf46704b6ad7b66ec7610959871bf8d6baafc3525811948f85b5dd84ab61bfa5a55e2b7e851b1d463aa432e4ff508f61cc62fc9596b20244bb559d5fee3ff3ecc0dfd557cb64798328d310e4f06c9f01228107520adbc8b3e5653310ba1a63959fe2df503fe7ad55644518012767cb91772a33fb3a004b39bcdb9148218365494c69305059e10a60693ebe6f17731f962c9577535c6a52b1dee1c2c9862923c0008d201d98a7fd9d6c6fcda8004bad0fb0eaee60e8308f91b605ad0dce70845ca79474258cab29dbefae13d93e41a83ccb70e35d7d6386fe08abbd823b3a12a3ca44ac6d3871675139df6807f396e6bd92ff8cb9b0356385d8729fb3168edf6a68408223b5ed82e59d13b57c4772eadcbe313b07b1dd3b693e41d3cd56d354e24e732947082a8998047e839cc0b4c066bf0a7e1a5b751c92c912310c3aa9cadc113e14458f843fc7b3756dbb99193f9541c9206a667eaa27b0fa184a4f77584c22fbb89269398acdf53c1e554400584ba87c50a86b8f591decd172ed7f5527abc533098dec7ed5b491cfebcaee2273d1f872314107273c21677fd17b99d1beffb47cd380d64079e920bb0bd91f81384df377e38551f7659a4c250383d0bbd253418273a0237db98179fbdc412207ff8eb14ff3d6de8502b516230865e229d55045bb4ccc67aeae905b854863c04cd28242d73ac6c3ee9c37fa756f1a2f86ab57f00d0fd9bf302760f2f6deac1b6e9df2658719032c1e47732c8fdb14adfb24b5e9e71de802877ea5b283060fe0160e376ea645e8e168047ff58824708c617cc781b2bb29fa20bd905fd3d2a43d8a0bd3a91fac338d97d91817af58df731f6509a38a6ef99ffc80c19e9afe9fe1e857370f6adcf4508aaa99091fc7e5a92a4a320e1e5521046b3f95f08eef44a945a9a9a5a99213ab0d57e35b7ba60e758f9f0c94317baeb97747d6258f3997b4542762c091575878883065bd777f82b47e0d481ac69ee7fe9202f5a2a50c8a55ecfb830609df1e1fde97f758933f4fded0497ef6a588381257276e156a70f9c39567d00fffe655010c087aeb80c830cecbbecca6993aceedea8ecabb1d0dd7293508a361891c4eaa99903c6ca76e0a2c044711017f81127e12459d379c78838ec07af14aff54f3755ac56ce6812452a99ebaab9b31e01bd0d04425dc23536bcc78f8d990a0bb501b11349f5c5c33a269351be091dc2c2727a19ff0bad2a67348b1d01a38a9580236120b7099a3e93347eed6296faaaceb221e8786391530fccba6984bc2c72192bed015c8b879b35dd9f5350b3ba6d4cb69811e879e2f158c2e597fd9f444b26506ac4205e827aea383bf316a33a0e2d5b66b85fcf8ac4e0055421e9543f0af5da607a72cf5922dcc56adebb2faa9aba2a3a3c8b401b2b19677ab53f0deae8650a71cc52dbbd049519cee276ae6d65c2c4db1641e5265d9ec68a9a19decc3a7edd1203cbd33b1f379127829e7e820955b2825130edd1601ba59b2aefeb1861b4688b1777436035239ec32a47da8b3f6cd774d345f22f6d0038cc9464cce131a0676b850fd1af704942d9b3c2eff7ef6b3a59b6a6b6ebc0cb728bbc394769f9a2ce5b8cd99dc41e12632bc45cedae7f70b41e9922ef4c9f56e74b9a659b7bf7b0c65a7c0afa5ba9c787f345b8a24fa459addbf932d798324ff2502409d3714d0ad8d65c7e1e7bfade84283fcba885e2084343ab19a08c7d123a5c1700845be464a769428f34ef727c1f530728afcc2b4909eba6f5ec6f9f75866c202db47f3b501bac34efade16109f065ec8c834f237bcedd8d7ef5cc44b96094869f177735ae053d92bd5fcab1319dec91a0b7860c80f29db874044af4d1a6f906231d9cd5fcb93411025bbc4b4b57753b622769dfb1e0dcdbc51e46a902b30d263b05fdc71340920e91c92ce8985ea0ea2f16a5917fd982ade0972848373cccf5fe0eb118d7e4f9296fbc5d6884965885fc55dd1ab35a93507321c5db885e02d41ce1414f0507cd2bd777986a30e446268ceeb24cddbf2edf51b21d30a6fd472199ab5838a7668c0c5fd885fb8d371d411fde2584ef6022187f565360b2c63a05602b5d8337c9eab91d360d104f6dd805f8b32089c063cd88126d8d7b8e5bf4656587ac4a16055560641ccde300d09ec79fdbf37de4e6672cce4161439f2c3def3de1557181062d788695b9371d02635af39fbe4b806b7c81b87d6c90afe97b3d016ba6cf3ba1ce6a34f5625e20172b214c50ebd4e0dcb4fd18013e85d389da8ad8290f5031b8f9972e2623c674e46ed22af19f962262c493fcc6ed8c8826b2761d9b6ed5511cd42b543cd15166a9cbc56705f23b847e7edefe960645780dee78059c444d4261667ad3056f1b9a280565e916c1f84fd4d944313ec926242a2f691e53ef83417031a2854b8b1b661c9c08e4422fa5ac394b874d6709031306b6ac5c48399697f7ffa7d1b3dcb093bd0dfc643b33b1a57a26f459373

sha256 (1)

dd75f024dcf21e06a0d6421d582690bf987a1f6323e32ad6619392f3bfde6bbd

CVEs (10)

CVE-2006-0225CVE-2008-1483CVE-2015-8325CVE-2016-6210CVE-2019-6111CVE-2020-14871CVE-2022-2274CVE-2023-38408CVE-2025-26465CVE-2025-26466

These observational values were auto-extracted from this report and are not a blocklist or a maliciousness verdict. Values shown are defanged for safe viewing. Downloads may contain live values. Review the source context before use.