OpenSSH flaw CVE-2026-123158 under active exploitation, researchers say

Key facts

• The flaw, CVE-2026-123158, requires OpenSSH running with musl and without PAM, plus specific password settings.
• Previdian said its sensors recorded 20 exploitation attempts from 13 unique attacker IP addresses in nine countries.
• Red Hat said the attacks exploit a "misinterpretation of whether a string is intended to be a password hash."
• The body says Alpine, a lightweight Linux distribution, is the most notable system at risk.

A vulnerability in OpenSSH, tracked as CVE-2026-123158, is being exploited, according to security firms watchTowr and Previdian. WatchTowr said on November 6 that it was seeing exploitation activity related to botnets and cryptocurrency. Previdian said its sensors had recorded 20 exploitation attempts from 13 unique attacker IP addresses geolocated to nine countries.

The flaw appears when OpenSSH runs alongside musl, a Linux alternative to the widely used libc code library, and does not use PAM, a framework that handles user authentication and account access checks. The configuration must also have at least one account accessible with a password hashed using SHA256 or SHA512 and be set to use passwordless accounts by specifying a "*" in the password field of the /etc/shadow file. Passwordless configurations are standard for certain types of accounts.

Exploits are triggered when an attacker enters a password longer than 256 characters for a passwordless account. When the OpenSSH server hashes the supplied password and checks it against the hash stored in /etc/shadow, the oversized password produces an error that causes musl's password hashing function to return "*". Red Hat described the attacks as exploiting the "misinterpretation of whether a string is intended to be a password hash."

Despite the multiple conditions required, the body says the flaw poses a serious threat to a large base of machines, most notably those running Alpine, a lightweight Linux distribution. It says the ease of exploitation lets attackers send malicious commands to any of the millions of SSH servers exposed to the internet and identify potentially vulnerable ones in seconds. The body advises anyone using OpenSSH to install the update promptly and those using musl to investigate further.