CVE-2026-54590Disclosure

LOWCVSS 5.9 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22CWE-639

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://tinyurl.com/5ts4m4rt

Full discourse1 post

Ferramentas Linux@Cezar_H_Linux91d
Disclosure
🚨 ATENÇÃO admins Fedora 44! O python-asyncssh tem duas vulnerabilidades críticas (CVE-2026-54590 e CVE-2026-54591). Saiba mais :- > https://tinyurl.com/5ts4m4rt https://t.co/oHLfPNhEgU
Post summary
The tweet announces that python‑asyncssh has two critical vulnerabilities (CVE-2026-54590, CVE-2026-54591) affecting Fedora 44, without providing PoC, exploit code, or remediation details.
1002079
1.5K followersView on X

Explore more

Back to dashboard