--- title: Critical security vulnerability affects OpenSSH on... description: OpenSSH 10.6p2 ships a workaround for a critical vulnerability on Linux systems that use musl libc with PAM disabled, such as Alpine Linux. OpenSSH developer... canonical: https://daily.dev/posts/critical-security-vulnerability-affects-openssh-on-alpine-linux-systems-zwvdlyaat twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Critical security vulnerability affects OpenSSH on Alpine Linux systems | daily.dev og:description: OpenSSH 10.6p2 ships a workaround for a critical vulnerability on Linux systems that use musl libc with PAM disabled, such as Alpine Linux. OpenSSH developer... og:url: https://daily.dev/posts/critical-security-vulnerability-affects-openssh-on-alpine-linux-systems-zwvdlyaat og:image: https://api.daily.dev/og/posts/ZWVdlyAaT.png og:image:alt: Critical security vulnerability affects OpenSSH on Alpine Linux systems og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Critical security vulnerability affects OpenSSH on Alpine Linux systems **[LWN.net](https://daily.dev/sources/lwn)** · 1 min read · 0 upvotes · 0 comments ## Summary OpenSSH 10.6p2 ships a workaround for a critical vulnerability on Linux systems that use musl libc with PAM disabled, such as Alpine Linux. OpenSSH developer Damien Miller urged affected users to immediately set PasswordAuthentication=no or disable SSH entirely. The bug does not affect non-Linux systems, Linux/glibc systems, or Linux systems using PAM for password authentication. Miller says the root cause lies outside OpenSSH itself, but a mitigation could still be shipped quickly. Alpine Linux will backport the fix all the way back to Alpine 3.16, released in May 2022. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is my Alpine Linux SSH server vulnerable to a critical OpenSSH security issue? Yes, if the system uses musl libc with PAM disabled for password authentication, which is the default on Alpine Linux. OpenSSH 10.6p2 ships a workaround. OpenSSH developer Damien Miller advised immediately setting PasswordAuthentication=no or disabling SSH on affected systems. The flaw does not affect non-Linux systems, glibc-based Linux, or Linux systems using PAM. _daily.dev surfaces security advisories like this one so you can patch before attackers find them._ ### How do I mitigate the OpenSSH musl libc vulnerability before patching? Set PasswordAuthentication=no in the SSH configuration or disable SSH entirely until the system is patched. This workaround was recommended for Linux systems running musl libc without PAM, such as Alpine Linux. OpenSSH 10.6p2 includes a fix, and Alpine Linux is backporting the patch as far back as Alpine 3.16, released in May 2022. _Teams managing Alpine fleets rely on daily.dev to catch urgent mitigation steps like this quickly._ ## Similar posts on daily.dev - [Critical Remote Code Execution Vulnerability in libssh2 Client Library Require Urgent Mitigation](https://daily.dev/posts/critical-remote-code-execution-vulnerability-in-libssh2-client-library-require-urgent-mitigation-uak3prjwd) · Arctic Wolf · 0 upvotes · 0 comments - [libssh2 CVE-2026-55200 Shows Why Outbound SSH Is an Attack Surface](https://daily.dev/posts/libssh2-cve-2026-55200-shows-why-outbound-ssh-is-an-attack-surface-pza5y7nfo) · Latest Hacking News · 1 upvotes · 0 comments - [OpenSSH 10.3 released](https://daily.dev/posts/openssh-10-3-released-krgsb6m3v) · LWN.net · 0 upvotes · 0 comments - [OpenSSH: Release Notes](https://daily.dev/posts/openssh-release-notes-iatm6rseu) · Lobsters · 2 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/critical-security-vulnerability-affects-openssh-on-alpine-linux-systems-zwvdlyaat) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Critical security vulnerability affects OpenSSH on Alpine Linux systems","url":"https://daily.dev/posts/critical-security-vulnerability-affects-openssh-on-alpine-linux-systems-zwvdlyaat","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/critical-security-vulnerability-affects-openssh-on-alpine-linux-systems-zwvdlyaat"},"datePublished":"2026-11-05T11:43:55.550Z","dateModified":"2026-11-06T02:51:38.062Z","description":"OpenSSH 10.6p2 ships a workaround for a critical vulnerability on Linux systems that use musl libc with PAM disabled, such as Alpine Linux. OpenSSH developer...","image":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","thumbnailUrl":"https://media.daily.dev/image/upload/s--0_ODbtD2--/f_auto/v1722860399/public/Placeholder%2008","isAccessibleForFree":true,"articleSection":"LWN.net","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"LWN.net","logo":"https://media.daily.dev/image/upload/s--4jjE7GIK--/f_auto,q_auto/v1774960833/logos/lwn?_a=BAMAMiWQ0","url":"https://daily.dev/sources/lwn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/critical-security-vulnerability-affects-openssh-on-alpine-linux-systems-zwvdlyaat","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,ssh","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"LWN.net","item":"https://daily.dev/sources/lwn"},{"@type":"ListItem","position":3,"name":"Critical security vulnerability affects OpenSSH on Alpine Linux systems"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/critical-security-vulnerability-affects-openssh-on-alpine-linux-systems-zwvdlyaat#faq","mainEntity":[{"@type":"Question","name":"Is my Alpine Linux SSH server vulnerable to a critical OpenSSH security issue?","acceptedAnswer":{"@type":"Answer","text":"Yes, if the system uses musl libc with PAM disabled for password authentication, which is the default on Alpine Linux. OpenSSH 10.6p2 ships a workaround. OpenSSH developer Damien Miller advised immediately setting PasswordAuthentication=no or disabling SSH on affected systems. The flaw does not affect non-Linux systems, glibc-based Linux, or Linux systems using PAM. daily.dev surfaces security advisories like this one so you can patch before attackers find them."}},{"@type":"Question","name":"How do I mitigate the OpenSSH musl libc vulnerability before patching?","acceptedAnswer":{"@type":"Answer","text":"Set PasswordAuthentication=no in the SSH configuration or disable SSH entirely until the system is patched. This workaround was recommended for Linux systems running musl libc without PAM, such as Alpine Linux. OpenSSH 10.6p2 includes a fix, and Alpine Linux is backporting the patch as far back as Alpine 3.16, released in May 2022. Teams managing Alpine fleets rely on daily.dev to catch urgent mitigation steps like this quickly."}}]} ```