Researchers at security firm watchTowr said Friday that they, too, were seeing exploitation activity, which was related to botnets and cryptocurrency. Security firm Previdian has also reported similar activity. It said its company’s sensors have seen 20 exploitation attempts from 13 unique attacker IP addresses geolocated to nine countries.
The vulnerability, tracked as CVE-2026-123158, resides in OpenSSH, when it runs alongside musl, a Linux alternative to the widely used libc code library. Further, OpenSSH must not use PAM (pluggable authentication modules), a framework that handles user authentication and account access checks. Additionally, SSH configurations must (1) have at least one account that’s accessible using a password that is hashed using the SHA256 or SHA512 function and (2) also be set to use passwordless accounts by way of specifying a “*” in the password field in the /etc/shadow file. Passwordless configurations are standard for certain types of accounts.
Exploits are triggered when an attacker enters passwords with more than 256 characters for a passwordless account. This step occurs when the OpenSSH server hashes the supplied password and checks it against the hash stored in /etc/shadow. The oversized password produces an error that causes musl’s password hashing function to return “*”. The attacks exploit the “misinterpretation of whether a string is intended to be a password hash,” Red Hat said.
Despite the multiple conditions necessary, CVE-2026-123158 poses a serious threat to a large base of machines, most notably those running Alpine, a lightweight distribution of Linux. The ease of exploitation allows hackers to direct malicious commands to any of the millions of SSH servers exposed to the Internet and identify potentially vulnerable ones in seconds. Anyone using OpenSSH should install the update promptly. Those using musl should investigate further.
