In Paramiko through 4.0.0 before a448945, rsakey.py allows the SHA-1 algorithm.

References

• https://github.com/paramiko/paramiko/commit/a4489456b6f65281e172380cc4826cee5e851dbb
• https://ostif.org/wp-content/uploads/2026/05/25-11-2415-REP_paramiko-security-audit_v1.1.pdf