Critical Vulnerabilities in Fedora's python-asyncssh Affect Multiple Versions

Fedora has released updates for python-asyncssh to address two critical vulnerabilities, CVE-2026-54590 and CVE-2026-54591, which allow unauthorized file modifications and arbitrary file writes through path traversal. These vulnerabilities affect versions 2.22.0 and earlier, with the latest patched version being 2.24.0. The vulnerabilities were published on July 8, 2026, and have been confirmed to impact systems using the authorized-keys directory escape method. Users are urged to update their systems to mitigate potential exploitation. The updates were made available through the 'dnf' package manager. The vulnerabilities could lead to significant security risks if left unaddressed, particularly in environments relying on SSH for secure communications.

Key Points: • CVE-2026-54590 allows unauthorized file modification via directory escape. • CVE-2026-54591 enables arbitrary file writes through path traversal in SCP client. • Users must upgrade to python-asyncssh version 2.24.0 to mitigate these vulnerabilities.