Paramiko SSH Library EUVD-2026-27514

Exploitation requires three specific conditions: (1) the SSH connection must use RSA host keys with algorithm identifier 'ssh-rsa' or 'ssh-rsa-cert-v01@openssh.com' (non-default on modern systems but common in legacy environments), (2) the Paramiko SSH client or server must have not disabled ssh-rsa in its SecurityOptions.preferred_pubkeys or Transport._preferred_keys configuration, and (3) the attacker must have network-level man-in-the-middle capability (AV:A per CVSS vector) to intercept the SSH handshake-this requires either shared network segment access (WiFi MITM), routing compromise, or DNS/BGP hijacking. The vulnerability does NOT exist in default configurations if the remote SSH server does not offer ssh-rsa (modern OpenSSH 8.8+ rejects it), nor if the Paramiko client explicitly excludes ssh-rsa from preferred algorithms. The high attack complexity (AC:H) reflects the difficulty of achieving adjacent network MITM and exploiting SHA-1 collisions in practice.

CVSS 3.4 (Low severity) with CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N indicates integrity impact (signature forgery) only, requiring adjacent network access and high attack complexity. The low CVSS contradicts the cryptographic severity: SHA-1 collision attacks are theoretically feasible but require significant computational resources (estimated USD 50,000-100,000 for targeted collision generation per SHAttered research). Real-world risk depends heavily on deployment context-SSH clients connecting to untrusted networks face MITM exposure, while servers in secured environments face lower risk. The OSTIF audit reference suggests this issue was identified through formal security review rather than active exploitation (no KEV status, no public POC identified). Attack complexity is HIGH because the attacker must either control network routing (ARP spoofing, BGP hijacking) to intercept SSH handshakes or compromise an intermediate certificate authority. The integrity-only impact (no confidentiality, no availability) further reduces practical risk compared to RCE vulnerabilities. However, the issue is FUNDAMENTAL to the protocol implementation and affects any Paramiko deployment accepting ssh-rsa keys-organizations running older SSH servers or clients that only support ssh-rsa remain vulnerable until both sides upgrade to SHA-2.

An attacker positioned on the same network segment as a Paramiko SSH client (e.g., corporate WiFi or compromised router) performs ARP spoofing or BGP hijacking to intercept SSH connection traffic. The Paramiko client attempting to authenticate to an SSH server accepts the attacker's forged host key because the attacker can exploit SHA-1 collision vulnerabilities to craft a rogue RSA public key that matches the target server's fingerprint under SHA-1 hashing. The client proceeds with authentication to the attacker's machine, leaking credentials or session keys. Alternatively, an attacker with SSH server access modifies the host key's RSA signature to a forged version exploiting SHA-1 weaknesses; connecting Paramiko clients accept it if configured to trust ssh-rsa.