Vulnerability that lets hackers SSH into Linux devices is under active exploitation

Security researchers at watchTowr and Previdian have confirmed active exploitation of CVE-2026-123158, a flaw affecting OpenSSH servers running on systems that use the musl C library instead of glibc. Previdian's sensors already logged 20 exploitation attempts from 13 distinct IP addresses across nine countries, and watchTowr links some of the activity to botnet and cryptomining campaigns.

The bug arises from a specific combination of conditions: OpenSSH must run with musl rather than glibc, without PAM authentication enabled, and the system must mix password-protected accounts (hashed with SHA256 or SHA512) with passwordless accounts marked by an asterisk in /etc/shadow. An attacker can then submit a password longer than 256 characters for a passwordless account, triggering a musl hashing error that returns an asterisk — which the server mistakenly treats as a valid match, as Red Hat explains, due to confusion between a password hash and a placeholder string.

Although several preconditions must align, the flaw is trivial to exploit and threatens large numbers of internet-facing SSH servers, particularly those running Alpine Linux. Administrators running OpenSSH are urged to patch immediately, while musl users should audit their configurations for exposure.