Researchers have identified active exploitation of a critical vulnerability in OpenSSH, tracked as CVE-2026-123158, which could allow unauthorized access to Linux devices. Security firms watchTowr and Previdian reported seeing multiple exploitation attempts linked to botnets and cryptocurrency activities, with Previdian noting 20 attempts from 13 unique IP addresses across nine countries.
Vulnerability Details and Exploitation Mechanics
The vulnerability arises when OpenSSH operates alongside musl, a lightweight alternative to the standard libc library, and does not utilize PAM (pluggable authentication modules). Specific SSH configurations must also be in place, including at least one account accessible via a password hashed with SHA256 or SHA512, and the use of passwordless accounts indicated by a “*” in the password field of the /etc/shadow file. This configuration is common for certain account types.
Attackers exploit the vulnerability by entering passwords exceeding 256 characters for passwordless accounts. This action triggers an error in the musl password hashing function, which misinterprets the input, allowing attackers to bypass authentication. Red Hat has noted that this misinterpretation is central to the vulnerability’s exploitation.
Impact and Recommendations
Despite the specific conditions required for exploitation, CVE-2026-123158 poses a significant risk, particularly to systems running Alpine Linux, which is widely used in various environments. The vulnerability’s ease of exploitation enables attackers to send malicious commands to millions of exposed SSH servers within seconds. Security experts strongly recommend that all users of OpenSSH apply the latest updates immediately, and those utilizing musl should conduct a thorough investigation of their systems.
For further details, see the report from Ars Technica.
