AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1,
    DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This
    likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able
    to execute. Further, the attacker is only receiving the digest, so should only be able to extract the
    user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability
    is fixed in 3.14.1. (CVE-2026-54276)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1,     DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This     likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able     to execute. Further, the attacker is only receiving the digest, so should only be able to extract the     user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability     is fixed in 3.14.1. (CVE-2026-54276)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
455373	Echo: python-aiohttp: security update to 3.14.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
455373	Echo: python-aiohttp: security update to 3.14.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
322139	Linux Distros Unpatched Vulnerability : CVE-2026-54276	Nessus	Misc.	Local	medium
443245	SCA: security update for aiohttp (GHSA-hpj7-wq8m-9hgp)	Tenable Cloud Security	SCA Checks	Local	medium
443245	SCA: security update for aiohttp (GHSA-hpj7-wq8m-9hgp)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-54276

medium

Tenable Plugins

medium

medium

medium

medium

medium