CVE-2026-123158 triggers remote root via musl password hash misparse in OpenSSH without PAM

The flaw exists only when OpenSSH links against musl libc, PAM is disabled, and /etc/shadow contains both SHA-256/512 hashed passwords and at least one passwordless account marked with ''. An oversized password forces musl's crypt() to return '' on error, which the server then treats as a successful match against the passwordless entry. WatchTowr and Previdian sensors recorded exploitation from 13 IPs across nine countries within days of disclosure, confirming active botnet and coin-mining campaigns targeting Alpine Linux instances.

Alpine powers the majority of container base images and many embedded routers; the same configuration pattern appears in millions of internet-exposed SSH daemons. Red Hat's advisory notes the misinterpretation occurs inside musl's hashing path rather than OpenSSH itself, explaining why glibc systems remain unaffected. Prior musl-related issues, including CVE-2019-14697 and buffer handling in earlier crypt implementations, show the library's error paths have repeatedly produced attacker-controlled return values.

Mitigation requires either switching to glibc, enabling PAM, or applying the forthcoming musl patch that returns a distinct error token. Operators should scan for '*' entries in shadow files on all Alpine-derived images and enforce key-only authentication before the next wave of automated scans completes enumeration.

Deployment telemetry from public IPv4 SSH censuses indicates over 1.2 million Alpine hosts accept password authentication; patch adoption can be tracked via the musl 1.2.6 release tag expected within 30 days.