OpenSSH musl flaw CVE-2026-123158 exploited for SSH access
Original title: Vulnerability that lets hackers SSH into Linux devices is under active exploitation
The bug needs musl, no PAM, a SHA-256 or SHA-512 password account, and a passwordless shadow entry; Alpine is most exposed.
Researchers say attackers are exploiting CVE-2026-123158 in OpenSSH when it runs with musl and without PAM, under specific password and shadow settings. watchTowr linked activity to botnets and cryptocurrency, and Previdian reported similar attempts. Red Hat described a misinterpretation of password-hash strings that can let an attacker authenticate to a passwordless account. Anyone using OpenSSH should install the update; musl users should check further.
Unconfirmed: Exploitation is reported by watchTowr and Previdian; a fixed version number is not stated.
- Previdian sensors saw 20 attempts from 13 IP addresses in nine countries.
- Passwordless accounts use “*” in the password field of /etc/shadow.
- The vulnerable hash functions named are SHA256 and SHA512.
- No fixed OpenSSH version is named in the report.
Impact: SSH access to passwordless accounts on exposed servers
| Product | Affected |
|---|---|
| OpenSSH | when run with musl, without PAM, and with the stated shadow settings |
- 1.Install the OpenSSH update promptly.
- 2.If using musl, check whether SSH matches the vulnerable configuration.
- CVEs
- CVE-2026-123158
- Vendors
- Red Hat
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-123158 | Password bypass in OpenSSH before 10.6p2 on musl without PAM | 8.1 | 17% | KEVPoC ×15 | KEV |
From the original article
1 min read at arstechnica.com
Researchers at security firm watchTowr said Friday that they, too, were seeing exploitation activity, which was related to botnets and cryptocurrency. Security firm Previdian has also reported similar activity . It said its company’s sensors have seen 20 exploitation attempts from 13 unique attacker IP addresses geolocated to nine countries.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.