CyberRota Analysis
AI-GeneratedDulwich versions up to 1.1.0 are vulnerable due to a lack of SSH host key verification in the contrib/paramiko_vendor.py module, which could allow attackers to perform man-in-the-middle attacks. This vulnerability poses a medium risk, particularly for environments that rely on secure SSH connections for data transfer. Organizations using Dulwich should prioritize patching to mitigate potential security risks associated with unverified SSH connections.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
GitHub PoC Links
Note: these links are listed for security research and verification purposes only.
CVE
CVE-2026-38974
Severity
MEDIUM
CVSS
5.3
EPSS
0.19%
Original NVD Description
Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.