Critical OpenSSH flaw CVE-2026-123158 actively exploited on Linux systems

Security researchers report active exploitation of CVE-2026-123158, a critical vulnerability involving OpenSSH and musl that can give unauthenticated attackers high-privilege access to some Linux systems. The flaw, tracked as CVE-2026-123158, became publicly known last Thursday, and multiple firms have since reported attacks. OpenSSH has released a fix, and users are urged to install it promptly.

How the vulnerability works

The vulnerability resides in OpenSSH when it runs alongside musl, a Linux alternative to the widely used libc code library. OpenSSH must not use PAM, and the SSH configuration must include at least one account accessible with a password hashed using SHA256 or SHA512. It must also use passwordless accounts by specifying '*' in the password field in /etc/shadow, a standard setup for certain account types. Exploits are triggered when an attacker enters a password with more than 256 characters for a passwordless account. The oversized password produces an error that causes musl's password hashing function to return '*', exploiting a misinterpretation of whether a string is intended to be a password hash, according to Red Hat.

Active exploitation reports

Greynoise said Monday that honeypots it maintains in Southeast Asia came under attack by a group it tracks as GT10, which conducted 'mature intrusions' into the systems. Greynoise later gained access to a GT10 server that revealed potential other victims and some tools used in the campaign. A backdoor used in the attacks contains Chinese language comments and appears to be generated with AI. GT10 is also installing Python3 on machines that lack it because the package is required to run the backdoor, tracked as TAC Agent, which supports shell commands, system reconnaissance, and persistence. Security firm watchTowr said Friday that it was seeing exploitation activity related to botnets and cryptocurrency, and Previdian reported similar activity. Previdian said its sensors saw 20 exploitation attempts from 13 unique attacker IP addresses geolocated to nine countries.

Who is at risk

Despite the multiple conditions required, CVE-2026-123158 poses a serious threat to a large base of machines, most notably those running Alpine, a lightweight Linux distribution. The ease of exploitation allows attackers to direct malicious commands to SSH servers exposed to the Internet and identify potentially vulnerable ones in seconds. Anyone using OpenSSH should install the update promptly, and those using musl should investigate further.

Sources: Ars Technica