Homepage

Directory Traversal Affecting airflow-3 package, versions <3.3.0-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.39% (33rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-AIRFLOW3-19385693
  • published28 Aug 2026
  • disclosed8 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 8 Jul 2026

CVE-2026-54590  (opens in a new tab)
CWE-22  (opens in a new tab)
CWE-639  (opens in a new tab)

How to fix?

Upgrade Minimos:latest airflow-3 to version 3.3.0-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream airflow-3 package and not the airflow-3 package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.