Back Linuxsecurity

Fedora 44 python-asyncssh Important Unauthorized File Write CVE-2026

Linuxsecurity •LinuxSecurity Advisories • July 20, 2026

update to version 2.24.0 Fix CVE-2026-54590: Unauthorized file modification via authorized-keys directory escape Fix CVE-2026-54591: Arbitrary file write via path traversal in SCP client

* Sun Jun 28 2026 Georg Sauthoff - 2.24.0-1 - update to version 2.24.0 (fixes fedora#2468438) * Fri Jun 12 2026 Yaakov Selkowitz - 2.22.0-6 - Rebuilt for openssl 4.0 * Thu Jun 4 2026 Python Maint - 2.22.0-5 - Rebuilt for Python 3.15 * Wed May 6 2026 Miro Hrončok - 2.22.0-4 - Properly filter out test dependency on uvloop and python-pkcs11

[ 1 ] Bug #2468438 - python-asyncssh-2.24.0 is available [ 2 ] Bug #2498421 - CVE-2026-54590 python-asyncssh: AsyncSSH: Unauthorized file modification via authorized-keys directory escape [fedora-all] [ 3 ] Bug #2498423 - CVE-2026-54590 python-asyncssh: AsyncSSH: Unauthorized file modification via authorized-keys directory escape [fedora-all] [ 4 ] Bug #2498488 - CVE-2026-54591 python-asyncssh: AsyncSSH: Arbitrary file write via path traversal in SCP client [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-1f248487e4' at the command line. For more information, refer to the dnf documentation available at

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Fedora's python-asyncssh Affect Multiple Versions Fedora has released updates for python-asyncssh to address two critical vulnerabilities, CVE-2026-54590 and CVE-2026-54591, which allow unauthorized file modifications and arbitrary file writes through path traversal. These vulnerabilities affect versions 2.22.0 and earlier, with the latest patched version being 2.24.0. The vulnerabilities were published on July 8, 2026, and have been confirmed to impact systems using the authorized-keys directory escape method. Users are urged to update their systems to mitigate potential exploitation. The updates were made available through the 'dnf' package manager. The vulnerabilities could lead to significant security risks if left unaddressed, particularly in environments relying on SSH for secure communications. 2 sources 71

Extracted Entities

Fedora 44 python-asyncssh Important Unauthorized File Write CVE-2026

The full story

Extracted Entities

Companies (1)

CVEs (2)

CWE Weaknesses (1)

Tools (2)