Overview
- OpenSSH maintainer released a fix in version 10.6p2 on Thursday, November 5, after researcher Özgün Kültekin disclosed CVE-2026-123158 that lets oversized passwords be misinterpreted as valid on musl-linked builds.
- Proof-of-concept exploit code appeared hours after the patch and scanners and attackers began probing exposed servers almost immediately.
- Security firms have observed successful intrusions that ran host and container reconnaissance, queried cloud metadata, tried to steal keys and hashes, and in some cases installed a Python implant called TAC Agent.
- The bug only affects OpenSSH builds that use musl libc with PAM disabled, have PasswordAuthentication enabled, and include at least one account whose /etc/shadow password field is '*', a setup common on Alpine and some embedded or cloud images.
- Operators should apply OpenSSH 10.6p2 and restart sshd or temporarily disable password authentication, and then search logs for unexpected "Accepted password" entries, unauthorized authorized_keys changes, and TAC Agent files or startup services.