CVE-2026-44467

Year

2026

Published

May 13, 2026

Known Affected Devices

CVSS Score

N/A

What is CVE-2026-44467?

The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known_hosts without comparing the server's presented host key against the stored key. This allowed a network-positioned attacker to present an arbitrary SSH host key and have the connection silently accepted, enabling a man-in-the-middle attack on remote development sessions. Successful exploitation required the attacker to be in a network position to intercept SSH traffic (e.g., via ARP spoofing, rogue Wi-Fi, or DNS poisoning) and the target hostname to already have an entry in the victim's known_hosts file. This vulnerability is fixed in 1.4304.0.

FAQ

How severe is CVE-2026-44467?

CVE-2026-44467 has a CVSS score of N/A/10, rated as Unknown. Review the affected products list and apply vendor patches.

What does the CVSS score mean for CVE-2026-44467?

CVSS (Common Vulnerability Scoring System) rates vulnerability severity from 0.0 to 10.0. CVE-2026-44467 scores N/A/10 (Unknown). Scores 9.0–10.0 are Critical, 7.0–8.9 are High, 4.0–6.9 are Medium, and below 4.0 are Low.

Which devices are affected by CVE-2026-44467?

The list of devices confirmed to be affected by CVE-2026-44467 is shown in the "Affected Devices" section above. Check your firmware version against the vendor security advisory and apply the latest patch.

How do I fix or mitigate CVE-2026-44467?

Apply the latest firmware or software update from the vendor. Check the References section above for official advisories and patch notes. If no patch is available, consider disabling the affected feature or isolating the device from untrusted networks.