CVE-2026-123158 Active Exploitation Confirmed on Musl libc OpenSSH Systems
Exploitation of the musl-specific OpenSSH bypass is underway but confined to automated actors. Evidence from multiple sensors shows rapid adoption after disclosure. Patching and password-authentication hardening remain the immediate requirements.
The flaw stems from OpenSSH's password verification logic on systems using musl libc without PAM. When an account stores '' as its hash field, sshd borrows salt from another entry. Long passwords cause musl crypt() to return '' instead of NULL, matching the target hash and granting access to root or key-only accounts on Alpine, OpenWrt, and similar embedded platforms. WatchTowr and Previdian documented live attempts starting November 6, 2026, with 13 unique IPs observed across nine countries. GreyNoise and Defused sensors recorded parallel activity limited to botnets and cryptocurrency miners. Contract and procurement records show heavy musl deployment in IoT and container images, creating a concentrated attack surface that standard glibc-focused testing missed.
Sources (3)
- [1]SecurityWeek Report(https://www.securityweek.com/hackers-exploiting-sshole-authentication-bypass-in-openssh/)
- [2]Previdian Sensor Data(https://previdian.com/reports/cve-2026-123158)
- [3]WatchTowr Exploitation Analysis(https://www.watchtowr.com/ssh-crypt-bypass)