Back Linuxsecurity

Fedora 43 python-asyncssh Critical Unauthorized Access Fix 2026

Linuxsecurity •LinuxSecurity Advisories • July 20, 2026

import asyncssh 2.23.1 Fix CVE-2026-54590: Unauthorized file modification via authorized-keys directory escape Fix CVE-2026-54591: Arbitrary file write via path traversal in SCP client

* Sat Jul 11 2026 Georg Sauthoff - 2.23.1-1 - import asyncssh 2.23.1 - fix CVE-2026-54590: Unauthorized file modification via authorized-keys directory escape (fixes fedora#2498421, fixes fedora#2498423) - fix CVE-2026-54591: Arbitrary file write via path traversal in SCP client (fixes fedora#2498488)

[ 1 ] Bug #2498421 - CVE-2026-54590 python-asyncssh: AsyncSSH: Unauthorized file modification via authorized-keys directory escape [fedora-all] [ 2 ] Bug #2498423 - CVE-2026-54590 python-asyncssh: AsyncSSH: Unauthorized file modification via authorized-keys directory escape [fedora-all] [ 3 ] Bug #2498488 - CVE-2026-54591 python-asyncssh: AsyncSSH: Arbitrary file write via path traversal in SCP client [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-574496d9ae' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Fedora's python-asyncssh Affect Multiple Versions Fedora has released updates for python-asyncssh to address two critical vulnerabilities, CVE-2026-54590 and CVE-2026-54591, which allow unauthorized file modifications and arbitrary file writes through path traversal. These vulnerabilities affect versions 2.22.0 and earlier, with the latest patched version being 2.24.0. The vulnerabilities were published on July 8, 2026, and have been confirmed to impact systems using the authorized-keys directory escape method. Users are urged to update their systems to mitigate potential exploitation. The updates were made available through the 'dnf' package manager. The vulnerabilities could lead to significant security risks if left unaddressed, particularly in environments relying on SSH for secure communications. 2 sources 71

Extracted Entities

Fedora 43 python-asyncssh Critical Unauthorized Access Fix 2026

The full story

Extracted Entities

Companies (1)

CVEs (2)

CWE Weaknesses (1)