[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1pBA3EjIX0yNEtBKStPCggqgNi-dxoXb24lcVmhDX7k":3},{"article":4,"iocs":49,"watch_terms":53,"solutions":54,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"3c980512-104b-4d59-a009-9e27f5edb16a","OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Servers","openssh-flaw-could-let-attackers-bypass-password-authentication-on-alpine-linux-784e21","A critical OpenSSH password authentication bypass could let remote attackers access affected Alpine Linux servers without knowing a password. Portable OpenSSH 10.6p2, released on November 5, 2026, adds a workaround for the flaw, which affects certain Linux systems using musl libc when PAM support is disabled. Alpine warns that exploitation needs only one connection and […] The post OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Servers appeared first on Cyber Security News.","A critical vulnerability in OpenSSH allows remote attackers to bypass password authentication on specific Alpine Linux servers. The flaw, affecting systems using musl libc with PAM disabled, requires only one connection and knowledge of an account name. A workaround is available in Portable OpenSSH 10.6p2, with Alpine Linux releasing patched packages for affected versions.","OpenSSH flaw allows passwordless authentication bypass on Alpine Linux servers.","https:\u002F\u002Fcybersecuritynews.com\u002Fopenssh-flaw-bypass-password-authentication\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FOpenSSH-Flaw-Bypass-Password-Authentication.webp","2026-11-05T14:58:40+00:00","2026-11-05T15:00:32.739395+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"OpenSSH","product",{"name":21,"type":19},"Portable OpenSSH 10.6p2",{"name":23,"type":19},"openssh-server",{"name":25,"type":19},"openssh-server-pam",{"name":27,"type":19},"tiny-cloud images",{"name":29,"type":30},"Alpine Linux","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39,44],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[50],{"type":43,"value":51,"context":52},"OpenSSH password authentication bypass","Exploitable vulnerability in OpenSSH",[29,18,21],{"controls":55,"vendors":143},[56,85,114],{"slug":57,"name":58,"problem":59,"products":60},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[61,69,77],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":86,"name":87,"problem":88,"products":89},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":115,"name":116,"problem":117,"products":118},"patch-management","Automated patch management","Known holes get closed in days, not months.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":156},"openssh-auth-bypass-exposes-alpine-linux-servers-to-passwordless-remote-access","OpenSSH Auth Bypass Exposes Alpine Linux Servers to Passwordless Remote Access","A critical flaw in OpenSSH allows attackers to completely bypass password authentication on Alpine Linux servers using musl libc with PAM disabled — requiring only a single connection and a valid account name. This matters because authentication is the most fundamental layer of access control; bypassing it grants attackers direct entry without needing credentials. The vulnerability highlights how platform-specific build configurations (musl libc + PAM disabled) can introduce unexpected security regressions in widely trusted software. Patches are available, making unpatched systems entirely indefensible against a trivially easy attack.",[149,150,151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":157,"NIST SP 800-53 SI-2: Flaw Remediation":158,"CIS Control 17: Incident Response Management":159,"OWASP A06:2021 Vulnerable and Outdated Components":160,"CIS Control 7: Continuous Vulnerability Management":161,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":162,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":163},"NIS2 requires entities to implement incident handling and vulnerability management practices; this bypass attack on critical infrastructure SSH access falls squarely within those obligations.","SI-2 requires organizations to identify, report, and correct information system flaws on defined timescales — directly mandating the emergency patch process needed here.","Organizations without a practiced incident response plan would struggle to rapidly scope, isolate, and remediate affected Alpine Linux servers once exploitation was detected or suspected.","Running an unpatched version of OpenSSH on a known-vulnerable OS build is a textbook instance of using a vulnerable component that OWASP A06 specifically targets.","A patched version was available; continuous scanning tied to a remediation deadline would have identified and closed the vulnerable OpenSSH configuration before attackers could exploit it.","A.8.8 requires timely identification and remediation of technical vulnerabilities, which would have mandated patching once Alpine Linux issued its advisory.","The vulnerability subverts authentication entirely; PR.AA's requirement to protect authentication mechanisms would have driven compensating controls such as MFA or certificate-based SSH."]