Claude Desktop CVE-2026-44467

Exploitation requires four concrete conditions, all derived from the advisory: (1) the victim runs Claude Desktop between 1.2581.0 and 1.4303.x and initiates the SSH remote development feature; (2) the target hostname already has an entry in the victim's ~/.ssh/known_hosts file (first-time connections to a host are not affected because no TOFU pin exists yet); (3) the attacker holds a network position capable of intercepting SSH traffic between victim and server, achieved via ARP spoofing, rogue Wi-Fi access point, or DNS poisoning (consistent with CVSS AV:A Adjacent, not Network); and (4) the victim performs the connection action (CVSS UI:P, passive user interaction). Limiting factors: the attack does not work against hosts the victim has never connected to before, it cannot be launched from arbitrary internet locations, and it requires the attacker to be on the same broadcast/routing domain or to control upstream DNS/DHCP for the victim.

Signals diverge: CVSS 4.0 rates the issue 7.4 High based on Adjacent attack vector (AV:A), low complexity (AC:L), no privileges (PR:N), but Passive user interaction (UI:P) and a Present attack requirement (AT:P) - meaning the user must initiate a connection and specific network conditions must hold. EPSS is 0.02% (4th percentile) and CISA SSVC reports Exploitation: none and Automatable: no, while Technical Impact is total because a successful MITM captures developer credentials, source code, and command output. The vulnerability is not in CISA KEV and no POC is referenced. Net effect: real impact is severe per session but the prerequisites (same-segment network position plus a pre-existing known_hosts entry for the victim's target) make opportunistic exploitation unlikely; the realistic threat is targeted attacks against high-value engineers on untrusted networks (coffee shops, conferences, hostile corporate LANs). Note the Tags field lists 'RCE' but the description and CWE describe MITM with high confidentiality/integrity impact, not direct code execution - the RCE tag should be treated as an upstream-source label, not as confirmation that remote code execution is the primary primitive.

A developer joins an untrusted Wi-Fi network at a conference and opens a Claude Desktop remote development session to dev-server.example.com, which they have previously connected to so an entry exists in their known_hosts. An attacker on the same segment uses ARP spoofing or rogue DHCP/DNS to redirect the SSH handshake to their own server, which presents an attacker-controlled host key; vulnerable Claude Desktop accepts the connection silently, after which the attacker proxies traffic to the real server while logging the developer's commands, source code, and any forwarded credentials. No public POC is referenced, but the attack uses well-known commodity MITM tooling (ettercap, bettercap, mitmproxy with SSH plugins).