Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Paramiko versions through 4.0.0 are affected. The rsakey.py module allows the SHA-1 algorithm, and the source gives few details about how this could be exploited. No fix is listed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 3.4 | Low | 3.1 | CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N | CNA (mitre) |
- CISA KEV Not listed.
- EPSS 0.0011, the 1st percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 6 May 2026, 00:31 UTC Confirmed by GitHub Advisory Database
- 31 Oct 2026, 14:11 UTC First seen by agentprime
- 31 Oct 2026, 14:11 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-r374-rxx8-8654
- OSV: GHSA-r374-rxx8-8654
- nvd.nist.gov/vuln/detail/CVE-2026-44405
- github.com/paramiko/paramiko/commit/a4489456b6f65281e172380cc4826cee5e851dbb
- github.com/advisories/GHSA-r374-rxx8-8654
- github.com/paramiko/paramiko
- github.com/pypa/advisory-database/tree/main/vulns/paramiko/PYSEC-2026-2858.yaml
- ostif.org/wp-content/uploads/2026/05/25-11-2415-REP_paramiko-security-audit_v1.1.pdf
- pypi.org/project/paramiko