CVE-2026-44405: Paramiko use of broken SHA-1 algorithm in RSA key handling

CVE-2026-44405 · Severity: low · CVSS 3.4 · Published 2026-05-06

Paramiko, a widely used Python library for making secure SSH connections, was found to support the outdated and insecure SHA-1 hashing algorithm for RSA keys. While this does not directly expose user data, it relies on a cryptographic method that is increasingly vulnerable to modern cyberattacks. Organizations using affected versions should update to ensure their encrypted communications meet current security standards.

Technologies: Paramiko, paramiko (PyPI). Vendors: Paramiko, PyPI.

Quick answers

Is CVE-2026-44405 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44405 being exploited in the wild.
How severe is CVE-2026-44405?
Low severity, with a CVSS score of 3.4, published 6 May 2026.
Which products and versions are affected?
Paramiko Through 4.0.0 before commit a448945; paramiko (PyPI) < 5.0.0, ECOSYSTEM:introduced=0,last_affected=4.0.0.
Is there a fix for CVE-2026-44405?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-44405 attacked?
It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-44405?
Check whether you run Paramiko or paramiko (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Paramiko's RSA key handling (specifically within rsakey.py and auth_handler.py) allows the continued use of the SHA-1 hashing algorithm. SHA-1 is considered cryptographically weak and susceptible to collision attacks. An attacker with adjacent network access could potentially exploit this reliance on broken cryptography to compromise the integrity of the SSH session, although the complexity is high (AC:H). The issue was identified during a security audit and addressed by removing SHA-1 support from RSA key handling in commit a448945.

Affected products

  • Paramiko Paramiko Through 4.0.0 before commit a448945

Identifiers

  • CVE-2026-44405
  • GHSA-r374-rxx8-8654
  • PYSEC-2026-2858

Timeline

  • 2026-05-05: disclosed
  • 2026-05-06: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.