OpenSSH: critical login flaw on musl libc Linux without PAM, workaround released in 10.6p2
CVE-2026-106552 CVE-2026-106553 CVE-2026-106555 CVE-2026-106582 CVE-2026-106583 CVE-2026-106584 CVE-2026-106585 CVE-2026-106586 CVE-2026-106587 CVE-2026-106588 CVE-2026-106589 CVE-2026-55653 CVE-2026-55654 CVE-2026-55655 CVE-2026-59995 CVE-2026-59996 CVE-2026-59997 CVE-2026-59998 CVE-2026-59999 CVE-2026-60000 CVE-2026-60001 CVE-2026-60002 CVE-2026-73281 CVE-2026-73282 CVE-2026-73283
Published 05/11/2026 11:39
Timeline
2 events over 13 d
- 22/10/2026 14:10ConfirmedBSI CERT-Bund (WID)+13 d
- 05/11/2026 11:39Published on WatchtowerPro CISO
In short
OpenSSH 10.6p2 is reported to include a workaround for a critical flaw affecting Linux systems that use musl libc without PAM, such as Alpine Linux. If you run such systems, set PasswordAuthentication=no or disable SSH on them now. Systems on glibc, with PAM, or not running Linux are reported as not affected. Shodan estimates 16.1 million internet-facing systems tagged with CVE-2026-106553 worldwide, 695,056 of them in the EU (05/11/2026).
How bad is it
Critical, according to the OpenSSH developer's post: affected musl libc Linux systems without PAM are at risk through password login, so disable password authentication now.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 25 CVEs · CVSS 3.1 from NVD, read 05/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Slow it down or interrupt it
Type: information disclosure.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Reported as affected by the critical login flaw: Linux systems that use musl libc without PAM for password authentication, such as Alpine Linux. Reported as not affected: non-Linux systems, Linux with glibc, and Linux systems that use PAM for password authentication. The post gives no OpenSSH version range.
- Debian bookworm and trixie are listed as vulnerable to the older flaws fixed in 10.6p1, with no Debian security advisory (DSA) yet.
Fixed in
- OpenSSH 10.6p2 is reported to contain a workaround for the musl/non-PAM flaw. The root cause is said to be outside OpenSSH, so this is a mitigation and not a root-cause fix. OpenSSH 10.6p1 fixes a batch of older flaws.
What to do now
- If you run Linux with musl libc and without PAM (for example Alpine Linux), set PasswordAuthentication=no or disable SSH on those systems immediately.
- Install OpenSSH 10.6p2 from the official OpenSSH release or your distribution's security update once available.
- Install the OpenSSH 10.6p1 updates your distribution offers, since they fix a batch of older flaws.
- Systems on glibc, with PAM, or not on Linux are reported as not affected by the new flaw.
- Interim measures reduce exposure and do not make a server safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 4 open questions, followed up as sources answer and all 6 sources with their dates. And technology matching: which of your systems run OpenSSH, at which version, fixed or not - and what each one needs.
Main sources
[UPDATE] [mittel] OpenSSH: Mehrere Schwachstellen CERT · [UPDATE] [hoch] OpenSSH: Mehrere Schwachstellen CERT · [UPDATE] [mittel] OpenSSH: Mehrere Schwachstellen CERT