CVE-2026-38974

Executive Summary

CVE-2026-38974 is a medium-severity vulnerability in Dulwich, a pure-Python implementation of the Git file formats and protocols, affecting all versions through 1.1.0. The flaw resides in contrib/paramiko_vendor.py, where the SSH host key verification is missing during SSH-based Git operations, enabling a man-in-the-middle (MITM) attacker to intercept, decrypt, and potentially modify repository data and credentials during clone, fetch, or push operations.

This vulnerability impacts any organization using Dulwich with the Paramiko SSH backend to interact with remote Git repositories. Given the prevalence of SSH as a transport for Git operations in enterprise environments and CI/CD pipelines, the attack surface is significant. An attacker positioned on the network path between a client using Dulwich and a legitimate Git server can impersonate the server, capture sensitive source code, embedded secrets, and authentication material, and potentially inject malicious code into the repository stream.

The full impact is magnified in automated contexts such as build pipelines and dependency management systems, where compromised repository data can lead to supply-chain attacks against downstream consumers. The CVSS score of 5.3 reflects a medium severity, particularly constrained by the high attack complexity (network-level man-in-the-middle positioning required) and the requirement for mutual user interaction in some client-server models.

Technical Analysis

Vulnerability Mechanism

Dulwich's contrib/paramiko_vendor.py implements a Paramiko-based SSH transport for Git operations. Paramiko is a Python implementation of the SSHv2 protocol, offering full client and server functionality. The vulnerability arises from the omission of host key verification during the SSH handshake.

In a properly secured SSH client, the host key verification process occurs as follows:

1. The client connects to the server, which responds with its host key.
2. The client checks the received key against its known_hosts database (or an equivalent trust-on-first-use [TOFU] mechanism).
3. If no prior record exists, the client prompts the user to confirm the key fingerprint.
4. If a record exists and matches, the connection proceeds; otherwise, the connection is aborted.

The vulnerable code in paramiko_vendor.py bypasses this entire process. Specifically, the SSHCommand class implementation does not enforce host key checks. In Paramiko, host key verification is controlled by the AutoAddPolicy, WarningPolicy, or RejectPolicy settings. Dulwich fails to implement any of these policies, defaulting to a permissive mode where any host key is accepted without validation.

A typical vulnerable code path appears conceptually similar to:

# Vulnerable pattern in paramiko_vendor.py
client = paramiko.SSHClient()
client.set_missing_host_key_policy(paramiko.AutoAddPolicy())  # OR NO POLICY SET AT ALL
client.connect(host, username=user, port=port, ...)

When the client object has no explicit host key policy, or when AutoAddPolicy is used, the client automatically accepts and records any host key presented. This includes keys presented by an attacker-in-the-middle. The theoretical code equivalent of AutoAddPolicy is:

class AutoAddPolicy(MissingHostKeyPolicy):
    def missing_host_key(self, client, hostname, key):
        # Automatically trusts ANY new key without user confirmation
        pass

Attack Surface

• Protocol: SSH (TCP port 22, or any custom port)
• Trigger: Any Dulwich operation using the Paramiko SSH vendor — clone, fetch, pull, push, ls_remote
• Prerequisite: Attacker must be able to intercept and relay network traffic (ARP spoofing, rogue DHCP, BGP hijacking, compromised network infrastructure, or DNS spoofing combined with IP-level interception)
• Context: Attack surface includes developers using Dulwich-based tools, CI/CD systems running automated Git operations, and applications using Dulwich as a Git library

Technical Nuances

The missing host key verification affects not only the initial connection but also subsequent connections to the same host. Because no key is ever pinned or validated, every connection is vulnerable to MITM, not just the first one. This distinguishes it from a TOFU weakness: even a client that previously connected to a legitimate server remains vulnerable on every subsequent connection.

Additionally, the lack of host key verification undermines all other SSH security mechanisms. The Diffie-Hellman key exchange encrypts traffic between the client and whatever endpoint is on the other side — but if that endpoint is an attacker, the encryption protects the attacker's interception session, not the client's legitimate session. Furthermore, authentication credentials (passwords or SSH private keys) are transmitted to the attacker, potentially enabling lateral movement into other systems using those credentials.

Exploitation Scenarios

The following attack chain describes a realistic exploitation of CVE-2026-38974:

Stage 1: Reconnaissance and Target Identification

The attacker first identifies targets that use Dulwich with the Paramiko SSH backend. These targets include:

• Git repositories using Dulwich to interact with remote servers over SSH.
• CI/CD pipelines (e.g., Jenkins, GitLab CI, GitHub Actions) configured with Dulwich-based tooling.
• Custom Python applications that leverage Dulwich for repository management.

Reconnaissance techniques include:

• Scanning for network traces or documentation referencing Dulwich.
• Identifying exposed or internal Git services using Shodan dorks such as http.title:"Dulwich" or product:"Dulwich" port:9418.
• Monitoring GitHub and public code repositories for paramiko_vendor.py imports.

Once a target is identified, the attacker determines the network path between the client and the legitimate Git server (e.g., git.example.com:22).

Stage 2: Man-in-the-Middle Positioning

The attacker positions themselves on the network path using any of:

• ARP spoofing — on a local network segment, the attacker spoofs the MAC address of the Git server's IP.
• Rogue DHCP/DNS — the attacker poisons DNS to redirect git.example.com to the attacker-controlled IP while relaying to the legitimate server.
• BGP hijacking — for more sophisticated operations, the attacker announces the victim's IP prefix to hijack routing.

The attacker prepares a malicious SSH server that presents a self-signed or attacker-generated host key. Because Dulwich skips host key verification, this key will be accepted without warning.

Stage 3: Connection Interception and Data Harvesting

The victim's application (e.g., a build script executing repo = DulwichRepo("ssh://git@git.example.com/repo.git")) initiates an SSH connection. The attacker's malicious SSHD receives this connection, terminates it, and initiates its own connection (port relay) to the legitimate SSH server at git.example.com:22.

During this relay:

1. The attacker's server captures the victim's SSH authentication credentials (password or private key).
2. All git protocol traffic (pack files, refs, push data) is decrypted by the attacker and re-encrypted to the legitimate server.
3. The attacker logs all traffic: source code, repository objects, and any embedded secrets.

For a push operation, the attacker can inject or modify data before relaying to the legitimate server — for example, adding a malicious commit to a repository the developer believes they are pushing to the legitimate server.

Stage 4: Post-Exploitation and Lateral Movement

The attacker leverages harvested data:

1. Credential reuse — the captured SSH password or private key is tested against other infrastructure (SSH to servers, AWS access keys, VPN credentials).
2. Source code theft — proprietary code is exfiltrated and sold or used as intelligence for further attacks.
3. Supply-chain compromise — the attacker injects malicious code or dependencies into the repository, which is then distributed via legitimate channels to downstream consumers (e.g., a Python package built from the compromised repository).

For supply-chain attacks specifically, the attacker can craft a malicious commit, push it to the legitimate server (using the captured credentials or the relay capability), and let the victim's CI/CD pipeline build and distribute the compromised package.

Realistic Constraints

This attack requires network-level access, which many organizations mitigate using encrypted VPN tunnels, but it also applies to less-secured environments such as public Wi-Fi, cloud VPCs with misconfigured network ACLs, or external unsegmented network segments. The absence of host key verification removes the last line of defense against such interception.

Impact Assessment

Business Impact

The business impact of CVE-2026-38974 is significant in organizations relying on Dulwich for Git operations:

• Confidentiality breach: Source code, proprietary algorithms, and embedded credentials are exfiltrated, risking intellectual property loss and regulatory exposure (e.g., PII stored in code or configuration files).
• Integrity compromise: Attackers can inject malicious changes into pushes or pulls, corrupting the development process and delivering backdoored software to customers.
• Availability degradation: In extreme cases, attackers can disrupt Git operations, render repositories unusable, or hold infrastructure hostage.

CVSS Subscore Significance

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N indicates:

• Attack Vector Network (AV:N): Remotely exploitable.
• Attack Complexity High (AC:H): Requires successful MITM positioning, which demands specific conditions.
• Privileges Required None (PR:N): No pre-existing access needed.
• User Interaction Required (UI:R): The victim (or an automated process leveraging a user interaction, like executing a script) must trigger a Git operation.
• Confidentiality High (C:H): Data theft is the primary impact.
• Integrity None (I:N): Static scoring excludes integrity impact, though real-world exploitation may include it.
• Availability None (A:N): No direct denial-of-service.

Attack Surface and Blast Radius

• Affected Systems: Any host running Dulwich <= 1.1.0 that connects to remote Git repositories over SSH. This includes developer workstations, build servers, and containerized CI/CD agents.
• Network Position: The vulnerability is exploitable from anywhere with network path visibility — local networks, ISPs, or cloud provider networks.
• Downstream Impact: For package maintainers using Dulwich in their build tooling, an exploited repository can lead to compromised releases, affecting thousands of downstream users.

Detection Guidance

Sigma Rule

title: Dulwich SSH Host Key Verification Bypass - CVE-2026-38974
id: 5f1a1b0e-6b2c-4c3d-8e4f-5a6b7c8d9e0f
status: experimental
description: Detects Dulwich processes attempting SSH connections without host key verification, indicating potential exploitation of CVE-2026-38974.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-38974
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/python'
        CommandLine|contains|all:
            - 'Dulwich'
            - 'ssh'
    condition: selection
level: medium
falsepositives:
    - Legitimate use of Dulwich by developers and build systems that intentionally skip host key verification.
fields:
    - CommandLine
    - ParentImage
    - DestinationHostname

YARA Rule

rule CVE_2026_38974_Dulwich_SSH_HostKey_Bypass
{
    meta:
        author = "ValterSIT Threat Intel"
        description = "Detects Dulwich paramiko_vendor.py source code missing SSH host key verification"
        cve = "CVE-2026-38974"
        date = "2026-01-15"
        severity = "medium"

    strings:
        $paramiko_import = "import paramiko" ascii wide
        $ssh_client = "paramiko.SSHClient()" ascii wide
        $vuln_call = "client.connect(" ascii wide
        $missing_policy = "set_missing_host_key_policy" ascii wide
        $func_git_command = "dulwich" ascii wide nocase

    condition:
        $paramiko_import and $ssh_client and $vuln_call and not $missing_policy and $func_git_command
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"CVE-2026-38974 - Potential Dulwich SSH MITM Exploitation"; flow:to_server,established; content:"SSH-2.0-"; detect:host_key_size; content:"ssh-dss"; metadata:cve CVE-2026-38974; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-38974; sid:202638974; rev:1;)

Elastic Detection

sequence by process.entity_id
  [process where event.type == "start" and process.name : "python*" and process.command_line contains "dulwich"]
  [network where event.type == "connection" and destination.port == 22 and process.name : "python*"]
  [process where event.module == "paramiko" and event.action == "connection_result" and paramiko.host_key_verified == false]

Splunk SPL Query

`python_processes`
| where process_command_line LIKE "%dulwich%"
| join type=inner process_id
    [ search index=network sourcetype=syslog
    | where dest_port=22
    | rename src_ip as client_ip, dest_ip as server_ip ]
| stats count by process_name, client_ip, server_ip, process_command_line
| where count > 3

Wazuh OSSEC Rule

<group name="dulwich,">
    <rule id="100389" level="8">
        <decoded>command</decoded>
        <description>Dulwich SSH connection without host key verification detected (CVE-2026-38974)</description>
        <field name="command">.*dulwich.*</field>
        <field name="command">.*ssh.*</field>
        <match>paramiko.SSHClient</match>
        <group>cve_2026_38974,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — single source (OSV) claims a patch exists; not independently confirmed.

1) Immediate Mitigations

• Restrict network access: Limit SSH connectivity from Dulwich-based clients to trusted, verified network segments using firewalls or network ACLs. Block outbound SSH (TCP 22) from development and CI/CD environments except where explicitly required.
• Use VPN or IPsec: Route all Git-over-SSH traffic through an encrypted tunnel protected by mutually authenticated endpoints, reducing the feasibility of MITM attacks.
• Monitor network traffic: Enable network monitoring to detect anomalies in SSH traffic patterns, such as unexpected hosts connecting to Git servers or multiple hosts connecting from the same IP.
• Avoid Dulwich for SSH operations: Temporarily switch to a well-maintained Git client (e.g., native git CLI) that enforces SSH host key verification, while the fix is validated.

2) Patch and Upgrade Steps

• Verify patch availability: Consult the OSV advisory listed in the patch sources to confirm the patched version.
• Upgrade Dulwich: Once confirmed, upgrade to the latest patched version using the Python package manager:

  pip install --upgrade dulwich
  # Alternative: conda update dulwich (if using conda)
  

• Validate patched version: After upgrading, verify the patched version includes host key verification in contrib/paramiko_vendor.py. Test against a known server to ensure set_missing_host_key_policy(paramiko.RejectPolicy()) or equivalent is now enforced.
• Update pinned dependencies: If Dulwich is vendored or pinned in requirements.txt or Pipfile, explicitly update the version constraint and re-run tests.

3) Long-Term Hardening

• Enable strict host key verification: In any Python code using Paramiko directly, always set a strict policy:

  client = paramiko.SSHClient()
  client.set_missing_host_key_policy(paramiko.RejectPolicy())  # or WarningPolicy for initial TOFU
  

• Implement certificate-based SSH: Use SSH certificates (CA-signed host certificates) rather than raw host keys to eliminate TOFU trust and enable automated revocation.
• Conduct security reviews: Integrate automated dependency scanning and code review into the SDLC to catch similar vulnerabilities in the future.
• Apply network segmentation: Restrict Git servers to isolated networks that are only reachable from authorized clients via controlled access paths.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-38974
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-38974
3. Dulwich Official Repository: https://www.dulwich.io/
4. Paramiko Documentation (Host Key Policy): https://docs.paramiko.org/en/stable/api/client.html#paramiko.client.SSHClient.set_missing_host_key_policy

Threat Actor Context: As of this writing, there are no known active exploit campaigns or evidence of exploitation in the wild for CVE-2026-38974. The EPSS score of 0.00195 (9.4th percentile of exploited CVEs) indicates a low probability of active exploitation in the near term. However, the vulnerability's severity is elevated in high-value targets such as proprietary source-code repositories, fintech, and government agencies due to the confidentiality impact and the relative ease of MITM positioning on unencrypted or misconfigured networks.