CVE-2026-44405

Executive Summary

CVE-2026-44405 is a low-severity (CVSS 3.4) vulnerability in Paramiko, a widely used Python SSH implementation, affecting versions through 4.0.0 before commit a448945. The flaw resides in rsakey.py, which permits the use of the deprecated SHA-1 algorithm for RSA key operations. While the vulnerability requires specific, non-default conditions to be exploitable, it undermines cryptographic integrity guarantees in SSH authentication, potentially enabling collision-based attacks in highly targeted scenarios. Enterprise environments relying on Paramiko for automated SSH authentication, CI/CD pipelines, and infrastructure orchestration should prioritize patching despite the low severity, as SHA-1 deprecation is part of a broader cryptographic migration strategy.

Technical Analysis

Paramiko is one of the most widely deployed SSH libraries in the Python ecosystem, used by Ansible, Fabric, pytest-sftpserver, and numerous internal automation frameworks. The vulnerability stems from the RSAKey class implementation in rsakey.py. The flaw allows the codebase to continue accepting or generating RSA signatures using the SHA-1 hash algorithm (RSA-SHA1), despite the industry-wide deprecation of SHA-1 following demonstrated collision attacks (SHAttered, 2017) and recommendations from NIST SP 800-131A.

From a code-level perspective, rsakey.py in Paramiko's key-handling module contains logic that selects hash algorithms for RSA operations—both for signing and verification. The vulnerable implementation does not enforce a strict minimum hash strength, meaning SHA-1 remains a permitted option. In practice, this manifests in several ways:

1. Signature Verification: When Paramiko is configured as a client or server and receives an RSA-SHA1 signature from a peer, it will verify it using SHA-1 rather than rejecting it outright.
2. Key Generation: If RSA key creation is triggered with parameter sets that lack explicit hash algorithm specification, SHA-1 may be silently selected.
3. Compatibility Paths: The code path likely exists for interop with legacy SSH servers/clients that still advertise ssh-rsa (which uses SHA-1) rather than rsa-sha2-256 or rsa-sha2-512.

The attack surface is cryptographic, not network-remotely exploitable in a classic memory-corruption sense. An attacker cannot directly "exploit" the SHA-1 usage without first obtaining a chosen-prefix collision against a legitimate signing key. The practical risk is that a threat actor who has already compromised a key pair (or can influence signed content) could forge signatures using SHA-1 collision techniques, which have become computationally feasible (estimated at $45K–$90K for chosen-prefix collisions as of 2020 research by Gaëtan Leurent and Thomas Peyrin).

The affected versions span the entire Paramiko 4.0.0 release line and earlier versions up to the point where commit a448945 introduces the fix. Since Paramiko 4.x is a major version without long-term support guarantees, the patched commit may be part of a 4.0.x point release or the main branch leading to a 4.1.0 release.

Exploitation Scenarios

While no public PoC exists for CVE-2026-44405, a determined attacker would construct an attack chain as follows:

1) Reconnaissance / Target Identification

• Attackers enumerate targets by scanning for exposed SSH services that accept Paramiko authentication (port 22, 2222, 2200). Shodan queries such as product:"OpenSSH" port:2222 or banner:"paramiko" can identify hosts running Paramiko-based SSH servers.
• For internal attacks, the attacker identifies applications that use Paramiko for outbound authentication (e.g., automated backup scripts, CI/CD runners connecting to Git repositories via SSH, configuration management systems like Ansible triggering ssh module).

2) Trigger / Weaponization

• The core requirement is obtaining a valid RSA signature generated with SHA-1 to feed into a collision attack. Two scenarios exist:
  • Chosen-Message Collision: If the attacker can influence the content of a signed message (e.g., by controlling SSH authentication banner data, or specific fields in a signed request), they craft two messages: one benign (to be signed by the legitimate key during an authentication handshake) and one malicious (carrying forged authentication data). The chosen-prefix collision makes both messages hash to the same SHA-1 digest, so the benign signature authenticates the malicious payload.
  • Downgrade Attack: The attacker performs a version downgrade against the Paramiko server by forcing it to reject rsa-sha2-256/512 and fall back to ssh-rsa (SHA-1). Many SSH implementations still support this fallback for legacy interop. The attacker then captures the SHA-1-based authentication signature.
• A practical step: The attacker intercepts the SSH handshake (MITM position) and modifies the algorithm negotiation packets to present SHA-1 as the only supported signature algorithm. Since Paramiko's vulnerable code accepts SHA-1, the handshake proceeds with the weak algorithm.

3) Payload / Execution

• Using the captured SHA-1 signature and a chosen-prefix collision generator (implementable with existing collision software like HashClash or stealth-pipeline), the attacker crafts an alternate authentication payload that collides with the legitimate signature.
• The forged authentication completes the SSH handshake, granting the attacker authenticated access to the target system, or allowing the attacker to impersonate the Paramiko client to a remote server (lateral movement).

4) Post-Exploitation Impact

• Successful exploitation results in: (a) unauthorized SSH access to servers using Paramiko-based authentication, (b) man-in-the-middle authentication bypass allowing attacker-injected commands in automated workflows, (c) integrity violation of signed artifacts if Paramiko is used in code-signing or deployment pipelines.
• The attacker maintains persistence by adding SSH keys to authorized_keys files on compromised hosts.

Impact Assessment

The CVSS base score of 3.4 indicates a Low severity vulnerability. The key contributing factors are the complexity of exploiting SHA-1 collisions (High attack complexity), the unprivileged nature of the attack (no privileges required, but requires MITM capability or key compromise), and the fact that confidentiality/integrity impacts are limited to authentication bypass scenarios.

Business Impact:

• Cryptographic Trust Degradation: Even without active exploitation, the presence of SHA-1 support violates compliance mandates (PCI-DSS, FedRAMP, NIST) that require SHA-256 or stronger.
• Automation Integrity: Organizations using Paramiko in CI/CD pipelines risk having automated deployments subverted through signature forgery, potentially injecting malicious code into production.
• Audit/Regulatory Risk: Security auditors flag any SHA-1 usage as a finding; failure to patch could result in compliance violations.

Affected Systems:

• All Python applications using Paramiko < patched commit: Ansible (pre-2.9, using Paramiko transport), older Fabric versions, custom scripts for server management, SFTP clients, and network device automation tools.
• Systems affected are not network devices per se, but Python-based automation hosts managing network infrastructure—making them high-value pivot points.

Blast Radius: The exploitation requires a MITM position or prior read access to a legitimate key's signed output. The attack is not wormable or remotely triggerable without those prerequisites. However, the affected install base (millions of Python deployments) means the latent risk across an enterprise is non-trivial.

Detection Guidance

The following detection rules focus on identifying abnormal SSH algorithm negotiation (SHA-1 fallback), anomalous Paramiko usage patterns, and cryptographic operations that deviate from expected profiles.

Sigma Rule

title: Paramiko SHA-1 RSA Algorithm Negotiation Detection
id: 9f3c2e4a-7b81-4d5c-9e1f-2a6b8c0d4e5f
status: experimental
description: Detects SSH handshake where RSA-SHA1 is negotiated, indicating potential CVE-2026-44405 exploitation or legacy interop.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44405
tags:
    - attack.t1190
    - attack.t1552.004
logsource:
    category: network_connection
    product: sshd
    definition: SSH server logs with algorithm negotiation details
detection:
    selection:
        ssh.server.signature_algorithm: "ssh-rsa"
    condition: selection
level: medium
falsepositives:
    - Legacy SSH clients that only support ssh-rsa
    - Deliberate configuration for old hardware

YARA Rule

rule Detect_Paramiko_SHA1_RSA_Use
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects Python bytecode or source referencing SHA-1 in Paramiko RSA key operations"
        cve = "CVE-2026-44405"
        date = "2026-01-01"
    strings:
        $sha1_import = "from hashlib import sha1" nocase
        $sha1_call = "sha1(" nocase
        $rsakey = "rsakey.py" nocase
        $algo = "ssh-rsa" nocase
        $padding = "PKCS1v15" nocase
        $verify_op = "verify(" nocase
        $sign_op = "sign(" nocase
    condition:
        (uint16(0) == 0x5A4D or uint16(0) == 0x4D5A) or filesize < 1MB and
        (1 of ($sha1_*) and $rsakey) or
        ($sha1_call and ($sign_op or $verify_op) and $algo)
}

Suricata IDS Rule

alert ssh any any -> any any (msg:"CVE-2026-44405 - Paramiko SHA-1 RSA Signature Algorithm Negotiation"; flow:established,to_server; content:"|00 00 00 0c|"; depth:4; content:"ssh-rsa"; fast_pattern:only; flowint:ssh.rsa.sha1,+, 1; threshold:type limit, track by_src, count 3, seconds 60; classtype:policy-violation; sid:10044405; rev:1;)

Elastic Detection

sequence by host.name with maxspan=5s
  [network where event.type == "start" and process.name : ("python3", "python") and
   network.protocol == "ssh" and network.transport == "tcp"]
  [file where event.action == "write" and file.path : "*paramiko*kex*"]

Splunk SPL Query

index=netflow OR index=ssh OR index=proxy
  | search "ssh-rsa"
  | stats count by src_ip, dest_ip, user, _time
  | where count > 0
  | eval severity = "medium"
  | table _time, src_ip, dest_ip, user, count

Wazuh OSSEC Rule

<rule id="100445" level="7">
  <if_sid>5715</if_sid>
  <match>ssh-rsa|SSH-RSA</match>
  <description>CVE-2026-44405: Paramiko SHA-1 RSA algorithm negotiation detected.</description>
  <group>authentication,failed,cryptography,</group>
  <mitre><id>T1190</id></mitre>
</rule>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1) Immediate Mitigations (if patching is delayed):

• Configure Paramiko to explicitly require rsa-sha2-256 and rsa-sha2-512 by overriding the Transport preference list in code or setting environment variables where supported.
• Disable SSH ssh-rsa algorithm at the server/network layer: edit sshd_config on Linux/Unix SSH servers to remove ssh-rsa from HostKeyAlgorithms and PubkeyAcceptedAlgorithms.
• Restrict Paramiko-using applications to run with minimal privileges (principle of least privilege) to reduce post-exploitation impact.
• Implement network segmentation so SSH automation traffic is isolated from external-facing zones, reducing MITM attack exposure.

2) Patch/Upgrade Steps:

• Identify installed Paramiko version: pip show paramiko (if not using pip for Python, use the correct package manager per your environment—e.g., poetry show paramiko, conda list | grep paramiko).
• Upgrade to the patched version that includes commit a448945. Since the exact fixed release number is not specified in the advisory, obtain the latest Paramiko release (>= 4.0.1 or the post-fix 4.x release). Command: pip install --upgrade paramiko.
• Verify the patch: pip show paramiko and confirm version is greater than the vulnerable range.
• Recompile any C extensions if using a source build; for containerized deployments, rebuild images from a patched base.

3) Long-Term Hardening:

• Enforce a cryptographic policy that rejects SHA-1 globally across all Python-based tools; implement via cryptography library dependency policies.
• Automate dependency scanning (e.g., using Trivy, pip-audit) to detect and alert on known-vulnerable Paramiko versions in CI.
• Migrate SSH authentication infrastructure away from RSA keys entirely to Ed25519, which provides modern security without algorithm negotiation ambiguity.
• Conduct a cryptographic asset inventory to identify all endpoints using SHA-1 signatures, and prioritize their migration.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-44405
2. OSV Advisory (patch source): https://osv.dev/vulnerability/CVE-2026-44405
3. Paramiko GitHub Repository (patch commit reference): https://github.com/paramiko/paramiko
4. NIST SP 800-131A Rev. 2 (SHA-1 deprecation guidance): https://csrc.nist.gov/publications/detail/sp/800-131a/rev-2/final
5. Leurent & Peyrin, "SHA-1 is a Shambles" (collision attack research relevant to exploitation feasibility): https://sha-mbles.github.io/

Threat Actor Campaigns: As of this report, no known active exploitation campaigns have been identified for CVE-2026-44405. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog, and the EPSS score (0.00114, 1.7th percentile) indicates a very low likelihood of exploitation in the wild within the next 30 days. However, given the widespread use of Paramiko in enterprise automation, this assessment should be revisited as the SHA-1 collision landscape evolves and tooling improves.