Linuxsecurity Critical Vulnerabilities in Fedora's python-asyncssh Affect Multiple Versions
Article Content
- •CVE-2026-54590 allows unauthorized file modification via directory escape.
- •CVE-2026-54591 enables arbitrary file writes through path traversal in SCP client.
- •Users must upgrade to python-asyncssh version 2.24.0 to mitigate these vulnerabilities.
Fedora has released updates for python-asyncssh to address two critical vulnerabilities, CVE-2026-54590 and CVE-2026-54591, which allow unauthorized file modifications and arbitrary file writes through path traversal. These vulnerabilities affect versions 2.22.0 and earlier, with the latest patched version being 2.24.0. The vulnerabilities were published on July 8, 2026, and have been confirmed to impact systems using the authorized-keys directory escape method. Users are urged to update their systems to mitigate potential exploitation. The updates were made available through the 'dnf' package manager. The vulnerabilities could lead to significant security risks if left unaddressed, particularly in environments relying on SSH for secure communications.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (2)
Following this threat?
Track Fedora and CVE-2026-54590 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host… 
PHP2Shell Vulnerabilities Exploited by AI-Driven Attackers Threat actors have exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) to target a government entity in Europe, gaining access to sensitive data within two hours of the initial breach. The attackers utilized AI tools for reconnaissance and post-exploitation activities, including accessing…