CVE-2026-44405: paramiko
Awaiting analysis
AliasesSUSE-SU-2026:22192-1SUSE-SU-2026:3031-1SUSE-SU-2026:3093-1GHSA-r374-rxx8-8654PYSEC-2026-2858UBUNTU-CVE-2026-44405DEBIAN-CVE-2026-44405CGA-36vh-xwgr-5wfvCGA-48wr-qmxq-v34gCGA-4jgq-xfmm-vf8qCGA-585c-p9v5-cr36CGA-6873-74c5-4wj7CGA-6jmp-rmjg-87c9CGA-7mf3-6vv2-p8w3CGA-9cm4-pvq3-cw7hCGA-9hf6-24v6-vv3xCGA-9hxv-grwr-8g24CGA-cwg4-v2cx-q43hCGA-fq96-7x6w-m92fCGA-g263-wjxr-3qhhCGA-hcwh-x2c2-9qwvCGA-hh32-wg96-h3hvCGA-j338-xvgx-6p67CGA-m96m-g77r-47c5CGA-mjwc-rg4w-86jhCGA-pfxc-mgrg-pc37CGA-qcw8-9p68-65xxCGA-qw4q-m3p6-vr33CGA-rr7f-xhgr-xqqjCGA-vjqf-7j27-8cvrCGA-wcrw-p44p-3qvxCGA-x7mp-7wrc-98q7CGA-xmmq-vw96-g9w9CGA-xwgj-r9g7-wx53openSUSE-SU-2026:21127-1CGA-23qr-w8g8-4r84CGA-26h3-3hgj-wj5pCGA-29w4-f642-jp86CGA-2f64-5v5v-793wCGA-2vvx-8jxh-22w5CGA-36q6-fp2j-jv8xCGA-3h9m-4jm8-jh85CGA-3mw2-wmpj-r8pcCGA-54j6-69g8-gmw7CGA-5vpw-7978-3f44CGA-6fj7-2g5g-rhqxCGA-6qcx-whrg-34mqCGA-77pp-qcpj-756hCGA-7g3f-m65g-x783CGA-7p7x-xxch-r9rcCGA-8438-7g28-gcxrCGA-87rm-q7r7-p93cCGA-8h35-g44j-fc4hCGA-8jgj-rmcj-q8g2CGA-92hc-p9f4-mh34CGA-949f-xc7m-rgjjCGA-9j8f-9234-m6hmCGA-9rrx-3m3f-rvmvCGA-c83f-697c-63qfCGA-cm8q-j56h-x55cCGA-fhgx-cp9v-pxmwCGA-fjhh-m5qp-jgffCGA-fp32-7pc3-grfjCGA-fpxf-hch7-pm4cCGA-ggvf-6p4h-r73vCGA-hhhc-j8fc-4675CGA-hx8v-gqrf-9gvmCGA-j5xw-j74x-vm9jCGA-jm53-c8qr-5392CGA-jprv-cr4f-v384CGA-jrvp-c3gc-923hCGA-m8qq-5mq7-c4xrCGA-mpqg-mpp4-g5wgCGA-p8jv-4q39-87hqCGA-q3jf-48pj-5fwvCGA-qc2h-pwxg-v54hCGA-qhc2-x673-qp9vCGA-qhvq-g3xj-r8vjCGA-qm8x-v793-g93fCGA-r635-p998-4hxhCGA-r9x8-f687-v6w2CGA-rhfh-r8h4-w64cCGA-rq9r-rqwg-9cm4CGA-rqw9-6mp3-v837CGA-w5c3-v3x8-8v85CGA-wc75-x559-rf6xCGA-x52r-qvxf-xvc3SUSE-SU-2026:4618-1
Published 05-05-2026Last modified 06-05-2026
Vulnerability summary
CVE-2026-44405 is a low (CVSS 3.4) vulnerability in paramiko. EPSS estimates a 0.11% chance of exploitation in the next 30 days, higher than 1.4% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 3.4, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
3.4/10
010
Low · v3.1 (CVE.org)EPSS score
0.11%
0%100%
Low · -0.01 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 2Timeline
- 05-05-2026PublishedVulnerability first disclosed.
- 06-05-2026Last modifiedVulnerability information updated.
Description
In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.
CVSS metrics
7 scores · 7 sources · 1 versionLow 3.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:NSourcesAll 7 agree
- OSV · PypiEcosystem advisory · calculated3.4LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated3.4LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated3.4LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated3.4LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated3.4LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
- NVDNIST3.4LowCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
EPSS trend
Probability
0.11%
Chance of exploitation in the next 30 days
Percentile
1%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 0.13% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard41 products
- airflow-2All versions (No fix recorded)
- airflow-3< 3.2.1-r2
- authentik-2025.12All versions (No fix recorded)
- authentik-2026.2All versions (No fix recorded)
- authentik-2026.5< 2026.5.6-r13
Wolfi14 products
- airflow-3< 3.2.1-r2
- az< 2.90.0-r0
- datadog-agent-7.72-core-integrations< 7.72.4-r21
- datadog-agent-7.73-core-integrationsAll versions (No fix recorded)
- datadog-agent-7.74-core-integrations< 7.74.1-r15
Suse5 products
- python-paramiko&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 3.4.0-150400.13.13.1
- python-paramiko&distro=SUSE Linux Enterprise Module for Python 3 15 SP7< 3.5.1-150700.20.6.1
- python-paramiko&distro=SUSE Linux Enterprise Server 16.0< 3.5.1-160000.3.1
- python-paramiko&distro=SUSE Linux Enterprise Server for SAP applications 16.0< 3.5.1-160000.3.1
- python3-paramiko&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 3.4.0-150400.9.9.1
Debian1 product
- paramikoAll versions (No fix recorded)
Opensuse1 product
- python-paramiko&distro=openSUSE Leap 16.0< 3.5.1-160000.3.1
Paramiko1 product
- paramiko< a4489456b6f65281e172380cc4826cee5e851dbb
PyPI1 product
- paramiko≤ 4.0.0
Ubuntu1 product
- paramikoAll versions (No fix recorded)
8 vendors · 65 products
References
16 links
- github.com/paramiko/paramikoPACKAGE
- pypi.org/project/paramikoPACKAGE
