CVE-2026-54276: aio-libs aiohttp
CVSS: 6.3v4.0MediumAnalyzed
AliasesGHSA-hpj7-wq8m-9hgpPYSEC-2026-2109UBUNTU-CVE-2026-54276DEBIAN-CVE-2026-54276CGA-23qg-6734-97ffCGA-5cgj-5x8r-5543CGA-6mwg-g49r-hf4hCGA-9w5h-qwh9-jqc2CGA-fhx4-rj66-46gqCGA-fpch-wmrw-74xfCGA-p796-7mr4-8274CGA-ph7h-6mrp-m29rCGA-qm4v-q383-p989CGA-x9h6-vwhm-mvp4CGA-25gv-3xw3-j5w3CGA-26cq-hvj8-723wCGA-2839-hfr4-6r9hCGA-297j-wx7f-72v3CGA-2p4f-x9mx-pq2rCGA-36vh-hprw-67p5CGA-3j7f-9g9q-jjgmCGA-5252-wx7m-4wp4CGA-64wr-x82c-cpfjCGA-6q56-mcvj-h8gjCGA-6w7p-vc76-c34gCGA-76gf-pq9f-57r5CGA-7hq7-w9qv-jm58CGA-85cw-x5pr-9cqvCGA-85hc-6g86-896qCGA-8694-f377-hpr6CGA-94vr-qfcp-8h2gCGA-96x6-m4cw-qx9qCGA-c356-vhcq-xq2jCGA-c6qc-cp9v-rc95CGA-cmr2-rh68-j9grCGA-f9j3-vg4h-g8v6CGA-fj3j-5gj5-5382CGA-fxxj-842p-5966CGA-g49v-r89x-744xCGA-gmf7-5296-h9x9CGA-gq25-f763-jpxqCGA-hg7h-jv2v-f3mfCGA-hg8q-qfwv-xqgcCGA-hhfx-vv26-6cjgCGA-jfm4-w4px-p8h2CGA-jr3w-959p-4j9xCGA-m3qw-5576-5gc9CGA-m7wr-gmw4-6v3jCGA-mvf2-vww7-q5r3CGA-mx5h-mx5c-pvp9CGA-p8q7-c7p4-7f6hCGA-p9p5-4m24-qqwfCGA-pchc-vmf7-rhg5CGA-qwrp-jqmj-24p5CGA-rg92-j6q6-hrqwCGA-vgr6-3ww6-p6g9CGA-vh9j-xqww-7ph4CGA-wgfv-g3x3-97fjCGA-xc6g-427j-7ch2CGA-xc92-px7r-g54wCGA-xpvq-hgmq-fc3g
Published 22-06-2026Last modified 23-06-2026
Vulnerability summary
CVE-2026-54276 is a medium (CVSS 6.3) vulnerability in aio-libs aiohttp. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22% of scored vulnerabilities.
CVSS score
6.3/10
010
Medium · v4.0 (CVE.org)EPSS score
0.31%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 22-06-2026PublishedVulnerability first disclosed.
- 23-06-2026Last modifiedVulnerability information updated.
Description
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This vulnerability is fixed in 3.14.1.
CVSS metrics
9 scores · 7 sources · 2 versionsMedium 6.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Medium 6.1Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.31% on 19-09-2026
19-09-202619-10-2026
EPSS score0.31%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-522Insufficiently Protected CredentialsThe product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
- CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Affected systems
Chainguard31 products
- airflow-2All versions (No fix recorded)
- airflow-3< 3.2.2-r7 | < 3.3.1-r0
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- airflow-core-2< 2.11.2-r6
- apache-beam-python-3.11-sdk< 2.74.0-r3
Wolfi4 products
- airflow-3< 3.2.2-r7 | < 3.3.1-r0
- airflow-3-iamguarded-compatAll versions (No fix recorded)
- mlflow< 3.16.0-r0 | < 3.13.0-r1
- open-webui< 0.9.6-r5
Aio-libs1 product
- aiohttp< 3.14.1
Aiohttp1 product
- aiohttp≥ 3.12.0, < 3.14.1
Debian1 product
- python-aiohttp< 3.14.1-1
PyPI1 product
- aiohttp< 3.14.1
Ubuntu1 product
- python-aiohttpAll versions (No fix recorded)
7 vendors · 40 products
References
8 links- github.com/aio-libs/aiohttp/security/advisories/GHSA-hpj7-wq8m-9hgpX Refsource CONFIRMWEBAdvisoryREPORTVendor Advisory
- github.com/aio-libs/aiohttp/commit/38d16060037e1bfcd6d677abababa3c2a4bb58faX Refsource MISCWEBFIXPatch
- github.com/aio-libs/aiohttpPACKAGE
