StackRadar

CVE-2026-54591

High

Advisory

Published 26 Aug 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.1
base score, highest
EPSS
0.005
41st percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
25
of 17,781 indexed, latest versions
Container images
21
deployed by those charts
Fix available
1 of 1
affected package

asyncssh has SCP Path Traversal to Arbitrary File Write

Carried by container images the latest versions of 25 of 17,781 indexed charts deploy, on 21 images.

Affected packageAffected versionsFixed inImages
asyncsshpypi2.7.0, 2.10.1, 2.13.2, 2.14.0+6 more2.23.121
OSV records
GHSA-2wxc-x7rj-hg8f
Also known as
PYSEC-2026-3808

Charts affected

25 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
asyncssh@2.14.2
2.23.1

Open the chart page →

11,367
rook-cephrookOfficialVerified publisher1.20.71 of 2See more

rook-ceph rook 1.20.7

1 of the 2 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
rook/ceph:v1.20.72f970c425617
asyncssh@2.13.2
2.23.1

Open the chart page →

1,447
ceph-csi-cephfsceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-cephfs ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
asyncssh@2.13.2
2.23.1

Open the chart page →

4,061
ceph-csi-rbdceph-csiOfficialVerified publisher3.17.11 of 6See more

ceph-csi-rbd ceph-csi 3.17.1

1 of the 6 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
asyncssh@2.13.2
2.23.1

Open the chart page →

4,061
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
asyncssh@2.10.1
2.23.1

Open the chart page →

7,705
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
asyncssh@2.14.2
2.23.1

Open the chart page →

6,041
home-assistantalekcVerified publisher2.11.21 of 1See more

home-assistant alekc 2.11.2

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
asyncssh@2.21.0
2.23.1

Open the chart page →

2,133
home-assistantandrenarchyVerified publisher14.103.01 of 1See more

home-assistant andrenarchy 14.103.0

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.1612d76760b54
asyncssh@2.21.0
2.23.1

Open the chart page →

2,133
home-assistanthome-assistantVerified publisher0.5.101 of 3See more

home-assistant home-assistant 0.5.10

1 of the 3 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
asyncssh@2.21.0
2.23.1

Open the chart page →

2,331
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
asyncssh@2.21.0
2.23.1

Open the chart page →

4,634
home-assistantgabe565Verified publisher0.17.01 of 1See more

home-assistant gabe565 0.17.0

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:latest612d76760b54
asyncssh@2.21.0
2.23.1

Open the chart page →

2,133
home-assistantpree-helm-chartsVerified publisher1.80.01 of 1See more

home-assistant pree-helm-charts 1.80.0

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
asyncssh@2.21.0
2.23.1

Open the chart page →

2,133
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
asyncssh@2.14.1
2.23.1

Open the chart page →

6,179
rook-cephdtrdnk-helm-chartsVerified publisher0.0.11 of 2See more

rook-ceph dtrdnk-helm-charts 0.0.1

1 of the 2 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
rook/ceph:v1.19.2944a1dd70496
asyncssh@2.13.2
2.23.1

Open the chart page →

1,990
home-assistantegebackVerified publisher2.0.351 of 1See more

home-assistant egeback 2.0.35

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
asyncssh@2.21.0
2.23.1

Open the chart page →

2,158
extended-ceph-exporterextended-ceph-exporterVerified publisher1.10.01 of 2See more

extended-ceph-exporter extended-ceph-exporter 1.10.0

1 of the 2 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
quay.io/ceph/ceph:v21.1.05ff3692d2f3f
asyncssh@2.17.0
2.23.1

Open the chart page →

2,885
home-assistanthelm-chart-roeiVerified publisher2025.3.01 of 1See more

home-assistant helm-chart-roei 2025.3.0

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
asyncssh@2.20.0
2.23.1

Open the chart page →

4,647
openbashelm-openbasVerified publisher1.8.141 of 7See more

openbas helm-openbas 1.8.14

1 of the 7 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
openbas/caldera-server:5.1.0a277796d9724
asyncssh@2.14.1
2.23.1

Open the chart page →

25,017
home-assistantkfirfer0.5.41 of 1See more

home-assistant kfirfer 0.5.4

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.10.3021e2afc6e57
asyncssh@2.14.0
2.23.1

Open the chart page →

6,447
home-assistantlmatfyVerified publisher0.1.381 of 1See more

home-assistant lmatfy 0.1.38

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2026.75a531753cea9
asyncssh@2.21.0
2.23.1

Open the chart page →

2,444
home-assistantpascaliskeVerified publisher0.1.11 of 1See more

home-assistant pascaliske 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
asyncssh@2.21.0
2.23.1

Open the chart page →

4,749
rada-platformrada-platform0.1.01 of 7See more

rada-platform rada-platform 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
apache/airflow:2.10.2-python3.9ce90bdc3d2af
asyncssh@2.17.0
2.23.1

Open the chart page →

21,211
rommromm-helm-chartVerified publisher1.5.51 of 3See more

romm romm-helm-chart 1.5.5

1 of the 3 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
rommapp/romm:5.2.03512f2ca4557
asyncssh@2.23.0
2.23.1

Open the chart page →

3,370
ceph-csi-cephfswikimedia0.1.81 of 5See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
asyncssh@2.7.0
2.23.1

Open the chart page →

10,285
ceph-csi-rbdwikimedia0.1.131 of 6See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2026-54591.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
asyncssh@2.7.0
2.23.1

Open the chart page →

11,784

Container images carrying it

21 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/home-assistant/home-assistant:2026.9.1:latest612d76760b54
asyncssh@2.21.0
2.23.1
2
ghcr.io/home-assistant/home-assistant:2026.9.2a1bc133af84e
asyncssh@2.21.0
2.23.1
2
quay.io/cephcsi/cephcsi:v3.17.10b62db8afc9b
asyncssh@2.13.2
2.23.1
2
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
asyncssh@2.7.0
2.23.1
2
apache/airflow:2.8.4-python3.964e58748b6b9
asyncssh@2.14.2
2.23.1
1
apache/airflow:2.10.2-python3.9ce90bdc3d2af
asyncssh@2.17.0
2.23.1
1
homeassistant/home-assistant:2023.10.3021e2afc6e57
asyncssh@2.14.0
2.23.1
1
homeassistant/home-assistant:2026.75a531753cea9
asyncssh@2.21.0
2.23.1
1
homeassistant/home-assistant:2023.12.48d000332b09b
asyncssh@2.14.2
2.23.1
1
openbas/caldera-server:5.1.0a277796d9724
asyncssh@2.14.1
2.23.1
1
rommapp/romm:5.2.03512f2ca4557
asyncssh@2.23.0
2.23.1
1
rook/ceph:v1.20.72f970c425617
asyncssh@2.13.2
2.23.1
1
rook/ceph:v1.19.2944a1dd70496
asyncssh@2.13.2
2.23.1
1
ghcr.io/home-assistant/home-assistant:2025.3.026c51e44d932
asyncssh@2.20.0
2.23.1
1
ghcr.io/home-assistant/home-assistant:2026.9.0372d991e5888
asyncssh@2.21.0
2.23.1
1
ghcr.io/home-assistant/home-assistant:2026.8.256690a89c79a
asyncssh@2.21.0
2.23.1
1
ghcr.io/home-assistant/home-assistant:2025.12.59a5a3eb4a213
asyncssh@2.21.0
2.23.1
1
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
asyncssh@2.10.1
2.23.1
1
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
asyncssh@2.14.1
2.23.1
1
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
asyncssh@2.21.0
2.23.1
1
quay.io/ceph/ceph:v21.1.05ff3692d2f3f
asyncssh@2.17.0
2.23.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.