The OpenSSH Bug Hiding in musl for Nearly a Decade

Özgün Kültekin of Wakefield uncovered SSHHole, a password-authentication bypass affecting certain Linux systems running OpenSSH against musl libc without PAM.¹

The unusual part is its history. Kültekin traces the failure through several decisions made across different projects over decades, eventually producing a condition where an account intended to reject password authentication can instead accept one.¹ OpenSSH independently confirmed the issue, credited Kültekin, and released 10.6p2 on November 5 with a workaround.²

The OpenSSH team also used the release to discuss a broader change in security research: AI-assisted bug discovery is becoming fast enough that the project now favors quicker security releases over longer batching cycles.² The original write-up reconstructs the chain in detail and includes tools for checking affected systems.