OpenSSH (< 10.6p2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/openssh--10.6p2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 20:26:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgOpenSSH: Password authentication bypass (sshole)https://feed.craftedsignal.io/briefs/2026-11-openssh-auth-bypass/Thu, 05 Nov 2026 20:26:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-openssh-auth-bypass/OpenSSH 10.6p2 addresses a password authentication bypass vulnerability affecting systems that utilize musl libc with PAM support disabled, such as Alpine Linux.OpenSSH 10.6p2 introduces a fix for a password authentication bypass vulnerability that affects systems built and running with PAM support disabled. While the OpenSSH maintainers state the root cause lies within the underlying musl libc, the flaw is exploitable via sshd. Alpine Linux is specifically identified as a system configuration where this issue is present. This vulnerability has been referred to as "sshole" in public disclosures.

Impact

The vulnerability allows an unauthenticated attacker to bypass password-based authentication mechanisms in sshd when the system is configured to use musl libc without PAM support, potentially leading to unauthorized remote access.

Recommendation

  • Upgrade OpenSSH to version 10.6p2 or later on all systems using musl libc where PAM is not enabled.
  • Audit existing server configurations to determine if PAM support is disabled in current OpenSSH installations.
  • Prioritize patching for Alpine Linux environments or similar distributions relying on musl libc.
]]>highadvisory