chiprook
← Security
SecurityOctober 21, 2026, 18:10

SSH client silently deletes trusted host keys and exits 0 with empty stderr

OpenSSH with UpdateHostKeys enabled can rewrite known_hosts during a normal login, removing keys the server does not announce and adding new ones. The removal appears only at debug3 verbosity, with exit status 0 and nothing on stderr. Reproduced on OpenSSH 9.2p1.

SSH client silently deletes trusted host keys and exits 0 with empty stderr
#OpenSSH
Read next
Security

OpenSSH silently rewrites known_hosts by default

Security

Hackers seized 333 Tor exit nodes to steal SSH credentials

Software

Claude Code silently deletes sessions older than 30 days

Software

canimcp reveals which MCP clients silently break your server's tools