Claude Desktop's SSH remote development feature, from version 1.2581.0 up to before 1.4304.0, only verifies that a hostname exists in the user’s ~/.ssh/known_hosts file but does not compare the server’s presented host key with the stored key. This omission lets an attacker who can intercept SSH traffic supply a forged host key; the application silently accepts the connection, allowing the attacker to intercept or modify the SSH session communication.

The vulnerable product is Anthropic’s Claude Desktop (Claude Code) used for remote development. Versions from 1.2581.0 through 1.4303.999 are affected. Any user running these releases with the target hostname already present in their ~/.ssh/known_hosts file is at risk.

The CVSS score is 7.4, reflecting a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to be in a network position to intercept SSH traffic (e.g., via ARP spoofing, rogue Wi-Fi, or DNS poisoning) and the target hostname must already have an entry in the victim’s known_hosts file. Once these conditions are satisfied, the attacker can carry out a man-in-the-middle attack without needing any additional privileges.