OpenSSH flaw CVE-2026-123158 lets attackers bypass authentication on musl libc systems

What happened

A critical vulnerability in OpenSSH, dubbed "SSHOle," allows unauthenticated attackers to bypass authentication on specific Linux configurations. The flaw occurs when sshd is running on a system using the musl C library with PAM disabled. In these environments, providing a password between 257 and 1,024 bytes causes a hashing failure that the system misinterprets as a successful match against accounts where the password hash is set to an asterisk (*).

Exploitation began almost immediately after disclosure. Previdian reported observing exploitation attempts less than nine hours after the CVE was published. One such attempt successfully gained root access on an Alpine Linux honeypot. Telemetry showed eight attempts originating from a single IP address located in Japan.

Why it matters

This is a high-impact flaw because it targets the very accounts often left without passwords for administrative or system use. If an attacker hits a target like Alpine Linux in its default configuration, they can bypass security entirely to gain the privileges of the compromised account. While the attack does not bypass standard passwords on accounts with valid hashes, it provides a direct path to any account where the password field contains an asterisk. For many Linux environments, this means an easy path to root or service-level access.

Who is affected

• OpenSSH versions before 10.6p2
• Linux systems using musl libc with PAM support disabled
• Alpine Linux (default configuration)

What to do now

1. Update OpenSSH to version 10.6p2 or your distribution's patched package.
2. Restart the sshd daemon after the update is applied.
3. Search /var/log/messages for Accepted password for entries involving accounts that should not accept password logins.
4. Review doas usage and inspect recently created users, files, or unauthorized authorized_keys.
5. Treat any machine showing unexpected password-based logins as a compromised system.

What we don't know yet

• The total number of successful exploitations occurring globally.
• The full scope of targeted organizations and specific victim counts.