Linode incident
Customer Security Advisory: OpenSSH Password Authentication Bypass Vulnerability [CVE-2026-123158]
Resolved on November 5, 2026, affecting Linode.com.
Akamai is aware of the password authentication bypass vulnerability affecting certain Linux systems using musl libc that was recently mitigated by an urgent OpenSSH update. Since Alpine Linux is specifically called out as being affected, we wanted to assure customers that Linode’s Alpine images are not affected by this vulnerability. Linodes using password-less provisioning do not have password authentication enabled by default unless customers change this configuration option in sshd_config after launch, while linodes launched using a password do not have any unlocked user accounts with a password hash set to ‘*’. However, we would like to use this opportunity as a reminder for customers to consider disabling password authentication permanently in favor of more secure mechanisms such as SSH keys or SSH CA certificates.
Affected components
Update timeline
- resolved Nov 05, 2026, 05:40 PM UTC
Akamai is aware of the password authentication bypass vulnerability affecting certain Linux systems using musl libc that was recently mitigated by an urgent OpenSSH update. Since Alpine Linux is specifically called out as being affected, we wanted to assure customers that Linode’s Alpine images are not affected by this vulnerability. Linodes using password-less provisioning do not have password authentication enabled by default unless customers change this configuration option in sshd_config after launch, while linodes launched using a password do not have any unlocked user accounts with a password hash set to ‘*’. However, we would like to use this opportunity as a reminder for customers to consider disabling password authentication permanently in favor of more secure mechanisms such as SSH keys or SSH CA certificates.
Your product runs on more than Linode
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services