{"id":"CVE-2026-44405","kind":"vulnerability","aliases":["CVE-2026-44405","GHSA-r374-rxx8-8654"],"related":[],"title":"Paramiko rsakey.py allows the SHA-1 algorithm","description":"In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.","summary":"Paramiko, a Python SSH library, still allows the SHA-1 hash algorithm in its RSA key handling. An attacker who can influence the signature exchange may be able to exploit SHA-1 weaknesses against connections made with it.","severity":"low","cvss":3.4,"epss":0.00114,"exploited":false,"exploited_at":null,"products":[{"name":"paramiko","fixed":["5.0.0"],"affected":"< 5.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["cwe-327","package","paramiko","python","ssh"],"not_affected_if":["no-rsa-keys-used","paramiko-5-or-later"],"how_to_check":"- Check the installed Paramiko version with `pip show paramiko` and compare it to the affected range below the fix line.\n- Search the codebase for `paramiko` to find services that use it for SSH connections.","fix":"- Paramiko: move to `5.0.0` or later.","status":"open","published_at":"2026-05-06T00:16:04+00:00","first_seen_at":"2026-11-07T00:25:02+00:00","triaged_at":"2026-11-07T00:26:46+00:00","updated_at":"2026-11-07T00:44:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T00:26:46Z","model":"claude-haiku-5-5","output":{"fix":"- Paramiko: move to `5.0.0` or later.","reach":"network","title":"Paramiko: RSA key code still accepts the weak SHA-1 algorithm","impact":"low","summary":"Paramiko, a Python SSH library, still allows the SHA-1 hash algorithm in its RSA key handling. An attacker who can influence the signature exchange may be able to exploit SHA-1 weaknesses against connections made with it.","audience":"developers","category":"package","nicknames":[],"who_cares":["python","paramiko","ssh"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"weakened RSA signature checks on SSH connections","analyst_note":"","how_to_check":"- Check the installed Paramiko version with `pip show paramiko` and compare it to the affected range below the fix line.\n- Search the codebase for `paramiko` to find services that use it for SSH connections.","plain_action":"","needs_analyst":false,"not_affected_if":["paramiko-5-or-later","no-rsa-keys-used"],"who_is_affected":"Any Python application that uses Paramiko for SSH or RSA key operations is in scope, with exposure depending on whether SHA-1 signatures can be negotiated with an untrusted peer. Applications that only use Paramiko with modern key types and trusted hosts are less exposed. unknown whether the sources give further detail on exploitation conditions.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000688,"input_tokens":4212,"output_tokens":533,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-1':6A,35B,57B,72C '-2026':9A,17A '-327':21B '-44405':10A,18A '4.0.0':65C '8654':15A 'a448945':67C 'abl':53B 'algorithm':7A,37B,73C 'allow':3A,32B,69C 'attack':44B 'connect':60B 'cve':8A,16A 'cwe':20B 'exchang':50B 'exploit':55B 'ghsa':12A 'ghsa-r374-rxx8':11A 'handl':42B 'hash':36B 'influenc':47B 'key':41B 'librari':30B 'made':61B 'may':51B 'packag':22B 'paramiko':1A,19A,23B,26B,63C 'python':24B,28B 'r374':13A 'rsa':40B 'rsakey.py':2A,68C 'rxx8':14A 'sha':5A,34B,56B,71C 'signatur':49B 'ssh':25B,29B 'still':31B 'weak':58B","nicknames":[],"mitigations":[],"who_affected":"Any Python application that uses Paramiko for SSH or RSA key operations is in scope, with exposure depending on whether SHA-1 signatures can be negotiated with an untrusted peer. Applications that only use Paramiko with modern key types and trusted hosts are less exposed. unknown whether the sources give further detail on exploitation conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["paramiko"],"ptokens":["paramiko"],"labels":["cwe327","low","package","paramiko","pypi","python","ssh"],"campaign_type":null,"search_a":"'-1':6A '-2026':9A,17A '-44405':10A,18A '8654':15A 'algorithm':7A 'allow':3A 'cve':8A,16A 'ghsa':12A 'ghsa-r374-rxx8':11A 'paramiko':1A,19A 'r374':13A 'rsakey.py':2A 'rxx8':14A 'sha':5A","search_b":"'-1':35B,57B '-327':21B 'abl':53B 'algorithm':37B 'allow':32B 'attack':44B 'connect':60B 'cwe':20B 'exchang':50B 'exploit':55B 'handl':42B 'hash':36B 'influenc':47B 'key':41B 'librari':30B 'made':61B 'may':51B 'packag':22B 'paramiko':23B,26B 'python':24B,28B 'rsa':40B 'sha':34B,56B 'signatur':49B 'ssh':25B,29B 'still':31B 'weak':58B","search_c":"'-1':72C '4.0.0':65C 'a448945':67C 'algorithm':73C 'allow':69C 'paramiko':63C 'rsakey.py':68C 'sha':71C","first_public_at":"2026-05-06T00:16:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-r374-rxx8-8654","url":"https://github.com/advisories/GHSA-r374-rxx8-8654","severity":"low","published_at":"2026-05-06T00:31:33+00:00","modified_at":"2026-11-07T00:21:04+00:00","first_seen_at":"2026-11-07T00:25:02+00:00","fetched_at":"2026-11-07T00:55:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-44405","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44405","severity":null,"published_at":"2026-05-06T00:16:04+00:00","modified_at":"2026-07-24T20:10:00+00:00","first_seen_at":"2026-11-07T00:44:49+00:00","fetched_at":"2026-11-07T00:44:49+00:00","note":null}],"documents":[{"id":91444,"url":"https://github.com/paramiko/paramiko/commit/a4489456b6f65281e172380cc4826cee5e851dbb","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[{"type":"epss","score":0.00114,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-44405"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}