Security Advisory: OpenSSH Vulnerability - No Impact to PDK – ProdataKey, Inc.

Date: November 6, 2026

Impact to ProdataKey: None (Not Affected)

Action Required: None

PDK is aware of the recently disclosed OpenSSH vulnerability known as “*sshole” (More information here and here). After a comprehensive review, we found that PDK products, including our Cloud Node appliances, are not affected and require no action or remediation.

About the vulnerability

*sshole is an authentication bypass in the OpenSSH server (sshd) in versions before 10.6p2. It only affects Linux systems built on the musl C library that check passwords without PAM. On those systems, a specially crafted, overly long password can let an attacker log in to accounts that should not accept password logins, including privileged accounts. Systems built on the more common glibc library are not affected. The attack only works when password authentication is enabled on the SSH server.

Why PDK products are not affected

PDK Cloud Nodes do run OpenSSH, but they are protected from *sshole in more than one way:

No musl library. PDK Cloud Nodes do not use the affected library.
Password authentication is disabled. The exploit's required authentication mechanism is not enabled on PDK hosts.
Additional hardening. Cloud Nodes have other OpenSSH and system security settings that further restrict remote access to the device.

Any one of these alone would prevent the attack.

Supplemental information on ensuring on-site PDK hardware is secure

PDK makes significant investments in the security profile of our products and training materials to ensure our web platform and shipped products are secure, but on-site responsibility remains. Security and reliability still depend on local decisions: hardware placement, network design and protection, the choice of locks, readers, and credentials, and how access is managed over time.

For more information on ensuring your PDK installation is as secure as possible, please review the information and instructions in our PDK Security and System Architecture - Technical White Paper.