CVE-2026-44405: Paramiko Package Vulnerability Allowing SHA-1 Algorithm Usage
Summary
CVE-2026-44405: Paramiko rsakey.py allows the SHA-1 algorithm. Affects paramiko versions < 4.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Paramiko is a widely used Python library that provides an interface for SSH2 protocol, enabling secure connections to remote servers. It is commonly utilized for automating server management and secure file transfers. The library supports various authentication methods and encryption algorithms, making it a critical component for developers working with secure communications. However, a vulnerability has been identified in versions prior to 4.0.0, which allows the use of the SHA-1 hashing algorithm, known for its weaknesses in security.
Vulnerability Detail
The vulnerability in Paramiko, identified as CVE-2026-44405, originates from the rsakey.py module, which permits the use of the SHA-1 algorithm for cryptographic operations. SHA-1 has been deemed insecure due to its susceptibility to collision attacks, which can lead to unauthorized access and data breaches. This vulnerability affects all versions of Paramiko up to and including 4.0.0, posing significant risks to applications relying on this library for secure communications.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, if you cannot immediately upgrade the package, consider avoiding the use of SHA-1 in your cryptographic operations and ensure that your application is configured to use stronger hashing algorithms such as SHA-256 or SHA-3.
Conclusion
The vulnerability identified as CVE-2026-44405 in the Paramiko library poses a significant risk due to the allowance of the SHA-1 algorithm. It is crucial for developers to update to the patched version 4.0.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for paramiko →
FAQ
CVE-2026-44405 is a vulnerability in the Paramiko library that allows the use of the insecure SHA-1 hashing algorithm.
If your application uses Paramiko versions up to 4.0.0, it may be at risk of security breaches due to the weaknesses of the SHA-1 algorithm.
As a temporary measure, avoid using SHA-1 for cryptographic operations and configure your application to use stronger algorithms.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 3.4, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for paramiko.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
