A Critical Vulnerability in OpenSSH is Being Exploited by Hackers
Hackers have begun exploiting a recently patched high-severity authentication bypass vulnerability in OpenSSH, a widely used secure shell client and server application. The flaw, tracked as CVE-2026-123158, could allow attackers to access certain accounts by supplying any password between 257 and 1024 characters.
The vulnerability arises from the way OpenSSH handles password hashes for user accounts. Normally, when an account has no stored password hash, the OpenSSH server will reject any login attempt that includes a password longer than 256 bytes. However, in certain Linux distributions that use the musl libc implementation with PAM disabled (such as Alpine, Buildroot, OpenWrt, Yocto, and others), these accounts do accept a password. This is because the OpenSSH server uses the salt from another account’s hash to process the login attempt when no stored hash exists.
When an attacker supplies a very long password (between 257 and 1024 characters), musl’s crypt() function fails to return NULL as expected, instead returning an asterisk (*). Since this matches the asterisk stored for the target account, OpenSSH treats the password as correct. As a result, attackers can gain access to sensitive accounts that should never accept passwords.
The affected accounts include root, any key-only users created with adduser without a password, and other specific user types on Alpine distributions. The vulnerability has been observed in the wild over the weekend, with WatchTowr and Previdian reporting exploitation attempts by botnets and crypto miners. GreyNoise and Defused have also reported similar activity.
OpenSSH released patches for the bug last week, urging users to update to version 10.6p2 as soon as possible. As a mitigation, users can disable password authentication (which is enabled by default in OpenSSH) or disable SSH altogether. They should also monitor their logs for unusual requests that may indicate exploitation attempts.
The rapid exploitation of this vulnerability highlights the importance of keeping software up to date and implementing robust security measures to prevent attacks. Users running affected Linux distributions should take immediate action to protect themselves against this critical threat.
Source: SecurityWeek — 2026-11-09