AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1,     DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This     likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able     to execute. Further, the attacker is only receiving the digest, so should only be able to extract the     user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability     is fixed in 3.14.1. (CVE-2026-54276)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1,
    DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This
    likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able
    to execute. Further, the attacker is only receiving the digest, so should only be able to extract the
    user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability
    is fixed in 3.14.1. (CVE-2026-54276)

ID	Name	Product	Family	Severity
322139	Linux Distros Unpatched Vulnerability : CVE-2026-54276	Nessus	Misc.	medium
443245	SCA: security update for aiohttp (GHSA-hpj7-wq8m-9hgp)	Tenable Cloud Security	SCA Checks	medium
443245	SCA: security update for aiohttp (GHSA-hpj7-wq8m-9hgp)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-54276

medium

Tenable Plugins

medium

medium

medium