PT-2026-38362 · Anthropic · Claude Desktop

Published 2026-05-07 · Updated 2026-05-13 · CVE-2026-44467

Positive Technologies (AI Summary)

CVSS v4.0

7.4

High

Base vector

AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Claude Desktop versions 1.2581.0 through 1.4303.0

Description The SSH remote development feature fails to compare the server's presented host key against the stored key, verifying only if the hostname exists in the ~/.ssh/known hosts file. This allows a network-positioned attacker to present an arbitrary SSH host key and have the connection silently accepted, enabling a man-in-the-middle attack on remote development sessions. A man-in-the-middle attack occurs when an attacker secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other. Exploitation requires the attacker to be able to intercept SSH traffic and for the target hostname to already have an entry in the victim's known hosts file.

Recommendations Update to version 1.4304.0.

Fix

Weakness Enumeration

CWE-297

CWE-322

Related Identifiers

CVE-2026-44467

Affected Products

Claude Desktop

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-44467 · Security Note
• https://github.com/anthropics/claude-code/security/advisories/GHSA-3rwf-2g6p-c2f9 · Note
• https://twitter.com/masato_anzai/status/2052193989982613802 · Twitter Post
• https://t.me/CVEtracker/53667 · Telegram Post