https://seclists.org/oss-sec/2026/q4/528: "sshole": password authentication bypass: OpenSSH + musl libc
Published Nov 5, 2026
·Updated
Affected Software
2 affected components
OpenBSD OpenSSH<10.6p2
musl musl libc
The issue affects some Linux systems using musl libc where sshd is built and run with PAM support disabled. Alpine Linux is specifically identified as one affected system.
The issue is exploitable through sshd password authentication. The provided information does not state that an attacker needs prior access or valid credentials.
OpenSSH 10.6p2 includes a fix that avoids the password-authentication bypass. The release notes characterize the OpenSSH change as a workaround for a root cause considered to be outside sshd.