OpenSSH flaw allowing SSH access to Linux devices is being actively exploited
Security firms watchTowr and Previdian report attacks on CVE-2026-123158, an OpenSSH vulnerability that appears when it runs with the musl library. Users are urged to install the update promptly.
Security firm watchTowr said on Friday that it is seeing active exploitation of the vulnerability CVE-2026-123158. The flaw affects OpenSSH, the widely used remote-access (SSH) server software on Linux systems. The activity is linked to botnets and cryptocurrency. Security firm Previdian has reported similar activity, saying its sensors recorded 20 exploitation attempts from 13 unique attacker IP addresses located in nine countries.
The vulnerability resides in OpenSSH when it runs alongside musl, an alternative to the widely used libc code library on Linux. Several further conditions must be met. OpenSSH must not use PAM (pluggable authentication modules), a framework that handles user authentication and account access checks. The configuration must include at least one account reachable with a password hashed using SHA256 or SHA512. It must also contain passwordless accounts, marked with a “*” in the password field of the /etc/shadow file. Such setups are standard for certain account types.
How the attack works
An attacker enters a password longer than 256 characters for a passwordless account. At that point the OpenSSH server hashes the supplied password and compares it with the value stored in /etc/shadow. The oversized password triggers an error that makes musl’s password hashing function return “*”. Red Hat said the attacks exploit the “misinterpretation of whether a string is intended to be a password hash.”
Risk and advice
Despite the number of required conditions, CVE-2026-123158 threatens a large base of machines, most notably those running Alpine, a lightweight Linux distribution. Because it is easy to exploit, attackers can send malicious commands to any of the millions of SSH servers exposed to the Internet and identify potentially vulnerable ones within seconds. Anyone using OpenSSH should install the update promptly, while those using musl should investigate further.
