OpenSSH bypass, Dokploy RCE, and Apache fixes

OpenSSH 10.6p2 closes a password authentication bypass on musl libc systems without PAM, while Dokploy and Apache Airflow disclosed remote code execution and secret-disclosure flaws. MIT Kerberos also shipped a release covering 21 CVEs.

OpenSSH fixes musl password authentication bypass

OpenSSH 10.6p2 fixes a password authentication bypass, dubbed sshole, on musl libc systems that are not using PAM. The flaw comes from crypt(3) returning '*'. An independent reproduction on stock Yocto embedded images was also reported on oss-security.

Dokploy database password change yields host RCE

An initial disclosure describes remote code execution in Dokploy 0.31.0, a project with 38k stars. A validator allows a backtick, so a member's database password change becomes host RCE. The vendor's own vector scores 9.9, and the issue was described as live-proven.

MIT Kerberos 1.22.3 fixes 21 CVEs

MIT Kerberos 5 1.22.3 is released with fixes for 21 CVEs discovered with LLM assistance. The announcement does not enumerate the individual issues. Sites running krb5 have a single release that closes that set.

Airflow CeleryExecutor accepts forged callback workloads

Apache Airflow disclosed that CeleryExecutor, before 3.4.0, runs forged callback workloads on Celery workers without workload-token validation. The issue is CVE-2026-68982 and is described as remote code execution via unauthenticated callback workloads. Deployments that use CeleryExecutor are the affected configuration.

Commons Codec Blake3 KDF example derives identical keys

CVE-2026-119078 covers Apache Commons Codec, where Blake3 doFinalize is stateless, so the documented KDF example derives identical keys. The problem dates to 1.16.0. Release 1.23.0 only updates the documentation.

Airflow Task SDK cache key leaks cross-team secrets

CVE-2026-76185 discloses a non-injective team cache key in the Apache Airflow Task SDK SecretCache. When multi_team and use_cache are both enabled, the collision allows cross-team secret disclosure. Multi-team deployments that cache secrets are the affected configuration.

Airflow DeadlineAlert bypasses deserialization gate

Apache Airflow disclosed CVE-2026-82337, rated moderate, in which DeadlineAlert fields bypass the plugin-registration gate for scheduler-side deserialization. The disclosure describes the issue as an incomplete prior fix. Scheduler deserialization of those fields is the exposure.