CVE-2026-38974: Dulwich SSH Host Key Verification Flaw

CVE-2026-38974 Overview

CVE-2026-38974 affects Dulwich versions through 1.1.0, a pure-Python implementation of the Git file formats and protocols. The vulnerability stems from missing SSH host key verification in the contrib/paramiko_vendor.py module. When Dulwich establishes SSH connections to remote Git repositories through the Paramiko vendor, it fails to validate the server's host key against a known trusted set. This omission enables machine-in-the-middle (MITM) attackers positioned between a client and a Git server to intercept, read, or modify repository traffic without detection.

Critical Impact
Attackers on the network path can intercept SSH-based Git operations, capture credentials, and inject malicious code into cloned or fetched repositories.

Affected Products

Dulwich versions through 1.1.0
Applications embedding dulwich.contrib.paramiko_vendor
Python tooling relying on Dulwich for SSH-based Git transport

Discovery Timeline

2026-07-15 - CVE-2026-38974 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-38974

Vulnerability Analysis

Dulwich provides a Paramiko-based SSH transport through contrib/paramiko_vendor.py. This module constructs an SSH client and connects to the remote Git server to run commands such as git-upload-pack and git-receive-pack. The vendor code omits configuration of a host key policy that rejects unknown servers. As a result, connections proceed regardless of whether the presented host key matches a previously trusted key. The defect maps to Improper Certificate Validation and Missing Authentication for Critical Function categories in the CWE taxonomy.

Root Cause

The Paramiko API requires callers to set a host key policy through set_missing_host_key_policy and to load known host keys before invoking connect. The affected Dulwich code path does neither, or uses a permissive policy equivalent to AutoAddPolicy. Without a strict policy such as RejectPolicy, Paramiko silently accepts any host key the remote presents. This behavior removes the authentication guarantee that SSH host keys are designed to provide.

Attack Vector

An attacker with a network position between the Dulwich client and the Git server initiates a MITM attack. The attacker terminates the client's SSH connection, presents their own host key, and forwards traffic to the real server. Because Dulwich does not verify the presented key, the SSH handshake completes. The attacker then observes Git protocol traffic, captures authentication material presented over the session, and can alter fetched objects to plant malicious commits in downstream builds. See the GitHub Pull Request #2123 for the technical fix details.

Detection Methods for CVE-2026-38974

Indicators of Compromise

Unexpected SSH host key changes reported by other Git clients connecting to the same remote
Git fetch or clone operations from Dulwich-based tooling connecting to non-standard IPs for known hosts
Repository content divergence between Dulwich-fetched clones and clones performed by verified Git clients

Detection Strategies

Inventory Python environments and identify installations of Dulwich at or below version 1.1.0 using pip show dulwich
Audit application code and CI/CD pipelines for imports of dulwich.contrib.paramiko_vendor
Compare hashes of objects fetched through Dulwich against a trusted reference clone to detect tampering

Monitoring Recommendations

Log outbound SSH connections from build agents and developer workstations and alert on new destination fingerprints
Enable network flow inspection between CI runners and Git hosting services to identify unauthorized intermediaries
Track Dulwich package versions across container images and virtual environments with software composition analysis

How to Mitigate CVE-2026-38974

Immediate Actions Required

Upgrade Dulwich to a version that includes the fix from GitHub Pull Request #2123
Replace usage of dulwich.contrib.paramiko_vendor with a vendor that enforces host key verification until upgrades complete
Rotate any SSH keys or tokens that were used over Dulwich-initiated SSH sessions on untrusted networks

Patch Information

The upstream fix is tracked in the Dulwich repository through pull request #2123. The change adds host key loading and a strict policy so that unknown or mismatched server keys terminate the connection before Git protocol data is exchanged. Consumers should pin to the first released version that includes this commit.

Workarounds

Configure Paramiko explicitly by calling client.load_system_host_keys() and client.set_missing_host_key_policy(paramiko.RejectPolicy()) before Dulwich invokes the transport
Route Git-over-SSH traffic through a controlled bastion that enforces host key pinning at the network layer
Prefer HTTPS with certificate validation for Git remotes in Dulwich-based automation until the patched release is deployed

bash

# Configuration example: enforce strict host key checking for Paramiko-backed transport
pip install --upgrade dulwich

# Pre-populate known_hosts for all Git remotes used by automation
ssh-keyscan -t rsa,ecdsa,ed25519 github.com >> ~/.ssh/known_hosts
ssh-keyscan -t rsa,ecdsa,ed25519 gitlab.com >> ~/.ssh/known_hosts

# Verify Dulwich version
python -c "import dulwich; print(dulwich.__version__)"