Customer Security Advisory: OpenSSH Password Authentication Bypass Vulnerability [CVE-2026-123158]

What to do

• Check whether you use Akamai Cloud (Linode) Linode.com. Check your stack

  Paste a package.json, lockfile, Terraform or a list of domains at down.guide/stack to see every provider you depend on.

• Confirm your retries, queues and scheduled jobs caught up after the 0m it lasted.

  Anything that failed between 2026-11-05 17:40 UTC and 2026-11-05 17:40 UTC may need a replay.

• Subscribe to Akamai Cloud (Linode)'s feed to hear about the next one first. RSS feed

  https://down.guide/feed?provider=linode works in Slack (/feed subscribe), Discord feed bots and any RSS reader.

Updates from Akamai Cloud (Linode) 1

1. resolvedNov 5, 2026, 5:40 PM UTC

   Akamai is aware of the password authentication bypass vulnerability affecting certain Linux systems using musl libc that was recently mitigated by an urgent OpenSSH update . Since Alpine Linux is specifically called out as being affected, we wanted to assure customers that Linode’s Alpine images are not affected by this vulnerability. Linodes using password-less provisioning do not have password authentication enabled by default unless customers change this configuration option in sshd_config after launch, while linodes launched using a password do not have any unlocked user accounts with a password hash set to ‘*’. However, we would like to use this opportunity as a reminder for customers to consider disabling password authentication permanently in favor of more secure mechanisms such as SSH keys or SSH CA certificates.

   provider

Corrections

None so far.

Something wrong on this page? Report an error or send us a note. Every fix is listed here.