The vulnerability, identified as CVE-2026-123158, affects OpenSSH systems that utilize the musl library instead of the standard libc. Successful exploitation grants unauthenticated access to high-privilege accounts within seconds. The flaw occurs when an attacker provides a password exceeding 256 characters for a passwordless account, causing a misinterpretation of the hashing function.
Security firm Greynoise reported that a group designated as GT10 is actively exploiting the flaw. The attackers deploy a backdoor named TAC Agent, which requires Python3 to function. Greynoise observed the group installing Python3 on compromised machines during their operations. The backdoor includes Chinese language comments and appears to be AI-generated.
Additional reports from watchTowr and Previdian confirm widespread exploitation attempts linked to botnets and cryptocurrency mining. Previdian sensors detected 20 attack attempts originating from 13 unique IP addresses across nine countries. The threat is particularly significant for Alpine Linux distributions, which commonly use the musl library.
To be vulnerable, a system must meet specific criteria: it must use OpenSSH with musl, lack PAM authentication, and contain at least one account with a SHA256 or SHA512 hashed password alongside a passwordless account marked with an asterisk in the /etc/shadow file. OpenSSH has already released a security update to address this issue.
