Researchers at security firm watch Towr and Previdian reported that a vulnerability in Open SSH, tracked as CVE-2026-123158, is under active exploitation. The flaw resides in Open SSH when it runs alongside musl, a Linux alternative to the widely used libc code library. Exploitation requires specific conditions: Open SSH must not use PAM, and SSH configurations must have passwordless accounts set via a "*" in the /etc/shadow file.
Additionally, at least one accessible account must use a password hashed with SHA256 or SHA512. Hackers trigger the exploit by entering passwords with more than 256 characters for passwordless accounts. This causes musl's password hashing function to return "*", allowing attackers to misinterpret the string and gain unauthorized access.
The vulnerability poses a serious threat to a large base of machines, most notably those running Alpine, a lightweight Linux distribution. The ease of exploitation allows hackers to direct malicious commands to millions of SSH servers exposed to the Internet and identify vulnerable ones in seconds. Despite the multiple conditions necessary, the threat is significant.
Anyone using Open SSH should install the update promptly, and those using musl should investigate further to mitigate the risk.
Source: Ars Technica · Summarized by HeadlinesBriefing