# Snyk: Trust page changed

> Snyk added an advisory about an OpenSSH password authentication bypass affecting sshd on musl-based Linux systems without PAM; Snyk says its environments are not impacted. Customers running affected systems should upgrade to OpenSSH 10.6p2 or higher, or set PasswordAuthentication no and restart sshd

Canonical: https://rewindex.com/change/p16314
Last updated: 2026-11-06T08:57:21Z

**Summary:** Snyk added an advisory about an OpenSSH password authentication bypass affecting sshd on musl-based Linux systems without PAM; Snyk says its environments are not impacted. Customers running affected systems should upgrade to OpenSSH 10.6p2 or higher, or set PasswordAuthentication no and restart sshd if they cannot update immediately. _(machine-written, sol)_
- Kind: Trust / security · Label: Changed (not classified) (rule)
- Changed: 2026-11-06 08:57 UTC · Detected: 2026-11-06 08:57 UTC
- [Source: https://trust.snyk.io](https://trust.snyk.io)
- [Company: Snyk](https://rewindex.com/company/snyk.md)
- Versions: before page\_version:13843 → after page\_version:16314
- Change 5 of 5 for this page

## What changed

**1. Added**

```diff
  …Privacy Policy and DPA? Updates View all General
+ Zero-Day Incident - OpenSSH Password Authentication Bypass
  - Update #1 Published ‹date› Overview On November…
```

**2. Added**

```diff
  …Bypass - Update #1 Published ‹date› Overview On
+ November 5, the OpenSSH project released 10.6p2, which fixes a password authentication bypass in sshd. If you run sshd on a Linux system built on musl (such as Alpine, OpenWrt, Buildroot, and Yocto) without PAM, an attacker may be able to access SSH without a password. To mitigate the vulnerability, you should update to OpenSSH 10.6p2. No CVE has been assigned yet.
  Is Snyk affected? As of this publication, based…
```

**3. Added**

```diff
  …available information, the Snyk environments are not impacted.
+ What you should do Upgrade to OpenSSH 10.6p2 Opens in new tab or higher (for example, apk upgrade openssh on Alpine). Alpine has patched and backported openssh-server in all releases from 3.16 through edge. The versions containing the fix are listed in the Alpine
  advisory Opens in new tab . If you…
```

**4. Added**

```diff
  …the Alpine advisory Opens in new tab .
+ If you can't update immediately: disable password logins by setting PasswordAuthentication no in your sshd configuration, then restart sshd. What comes next? We will continue to monitor the situation, add advisories as Linux distributions publish theirs, and provide updates as additional information becomes available.
  If you have questions, please contact your Snyk…
```

**5. Added**

```diff
  …Read more Read more about Zero-Day Incident -
+ OpenSSH Password Authentication Bypass - Update #1
  General Snyk is standardizing SCM file access on…
```

_2 noise-only block(s) hidden (dates, counters, testimonials, tokens)._

## History of this page

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-22 08:57 UTC | [Trust page changed](https://rewindex.com/change/p5414.md) | Changed (not classified) |
| 2026-10-29 09:03 UTC | [Trust page changed](https://rewindex.com/change/p10516.md) | Changed (not classified) |
| 2026-10-31 09:00 UTC | [Trust page changed](https://rewindex.com/change/p12090.md) | Changed (not classified) |
| 2026-11-03 08:57 UTC | [Trust page changed](https://rewindex.com/change/p13843.md) | Changed (not classified) |
| 2026-11-06 08:57 UTC | Trust page changed (this change) | Changed (not classified) |

Previous: [change](https://rewindex.com/change/p13843.md) · All Snyk changes: [timeline](https://rewindex.com/company/snyk/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._

## Cite this

Trust page changed on Snyk’s Trust page, changed 2026-11-06 08:57 UTC (change 5 of 5).

- Canonical URL: https://rewindex.com/change/p16314
- Citation: Snyk, “Trust page changed” (2026-11-06 08:57 UTC). Archived by Rewindex: https://rewindex.com/change/p16314 (CC BY 4.0).
- Markdown link: `[Snyk: Trust page changed (2026-11-06)](https://rewindex.com/change/p16314)`


---
Canonical: https://rewindex.com/change/p16314 · Markdown: https://rewindex.com/change/p16314.md · JSON: https://rewindex.com/api/v1/changes/p16314 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-11T04:20:13.708Z