CVE-2026-44405 Paramiko rsakey.py allows the SHA-1 algorithm
The Paramiko library allows the use of the weak SHA-1 algorithm, potentially enabling cryptographic attacks against SSH connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44405?
CVE-2026-44405 is a low-severity vulnerability in Paramiko, published on 5 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.
Weakness: CWE-327
Which versions are affected by CVE-2026-44405?
3 open source packages ship an affected version, including paramiko.
| Package | Affected | Fixed in |
|---|---|---|
paramiko PyPI | All versions to 4.0.0 | None |
paramiko PyPI | All versions to 4.0.0 | None |
paramiko PyPI | All versions to 4.0.0 | None |
Linux distribution packages (6)
python3-paramiko SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 3.4.0-150400.9.9.1 |
python-paramiko SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 3.4.0-150400.13.13.1 |
python-paramiko SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 3.5.1-150700.20.6.1 |
python-paramiko SUSE:Linux Enterprise Server 16.0 | All versions | 3.5.1-160000.3.1 |
python-paramiko SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 3.5.1-160000.3.1 |
python-paramiko openSUSE:Leap 16.0 | All versions | 3.5.1-160000.3.1 |
How do I fix CVE-2026-44405?
Apply the vendor's patch.
Is CVE-2026-44405 being exploited?
There is no known exploitation of CVE-2026-44405 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-IK87467, CLSA-2026-1781571264, DEBIAN-CVE-2026-44405, GHSA-r374-rxx8-8654, MINI-237c-w7mc-4f4h, MINI-7gc9-hjff-q2j8 and 11 more.