Summary: 

On November 5, 2026, OpenSSH released version 10.6p2 to fix a password authentication bypass, publicly referred to as "sshhole". It affects OpenSSH sshd 7.3p1 through 10.6p1 on Linux systems that use musl libc, such as Alpine Linux, when sshd runs without PAM, which is the Alpine default. On an affected system, a password of 257 to 1024 characters can be accepted for an account that has no password set, such as root on Alpine. Exploitation requires password authentication to be enabled, which is the OpenSSH default.

Redpanda has reviewed the container images and infrastructure used by Redpanda Cloud and Redpanda Self-Managed. The Redpanda Console container image is the only Redpanda image that is built on Alpine Linux and includes the OpenSSH server. The Console image does not start sshd: its entrypoint is the Console binary, and the OpenSSH package is included only so Console can use the SSH client. Because sshd is not running, the vulnerability cannot be reached in a default deployment.

Image scanners may report this vulnerability against the Redpanda Console image, because the image includes the OpenSSH package. Alpine's security database does not yet list the fix, so scanners may keep flagging the image even where OpenSSH is patched. The finding is not exploitable unless sshd is started inside the Console container.

Severity: 

Low. 

Redpanda Products Affected:

• Redpanda Console - Self Managed - Version under 2.8.19 or 3.14.0

  • only if sshd is enabled (non default)

Redpanda Console releases (2.1.19 and 3.14.0), Redpanda have removed the OpenSSH server (sshd) from the image and ship only the OpenSSH client.

Release Affected:

Redpanda Console container images (redpandadata/console), all current releases. These images are built on Alpine Linux and include the OpenSSH package, but they do not run sshd by default.

Not affected: All other redpanda offerings have been verified to not have an impacted image.

Identification:

A Redpanda Console deployment is affected only if all of the following are true:

• sshd has been started inside the Console container, for example by a custom entrypoint, a command override or a derived image.

  • This is not the default and never recommended.

• The SSH port is reachable from a network you do not fully trust.

• Password authentication is enabled, which is the OpenSSH default.

To check whether sshd is running in a Console container:

• Kubernetes: kubectl exec -n <namespace> <console-pod> -- ps

• Docker: docker exec <console-container> ps

If no sshd process appears in the output, the deployment is not affected.

Impact: 

Redpanda Cloud: None.

Redpanda Self-Managed (with sshd enabled in the Console container): An unauthenticated attacker who can reach the SSH port could log in as an account with no password set, including root, and take full control of the container. This could expose the Console configuration and any credentials it holds, such as Kafka, Schema Registry and Admin API credentials.

Action required: 

Redpanda Cloud: No action required.

Redpanda Self-Managed (with the default Console configuration): No action required. Do not enable sshd, and upgrade to Console 2.1.19 or 3.14.0 or higher at your convenience.

Redpanda Self-Managed (with sshd enabled in the Console container):

1. Stop sshd in the Console container (recommended). Console does not need sshd to operate.

2. If you cannot stop sshd right away, set PasswordAuthentication no in sshd_config and restart sshd. Upgrading OpenSSH in the image to a build that includes the OpenSSH 10.6p2 fix also closes the issue, but it means modifying the Redpanda-provided image.

3. Upgrade to the next Redpanda Console release when it is available. That release removes the OpenSSH server from the image.

4. Review authentication logs for successful password logins to accounts that have no password set, which can indicate exploitation. If you find any, rotate the credentials configured in Console.

5. Upgrade to Console 2.1.19 or 3.14.0 or higher at your convenience.

Questions? If you have any questions on this TSB, or need further guidance, please contact Redpanda Support