Path Traversal in AsyncSSH AuthorizedKeysFile Handling

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-54590

Affected Vendors & Products

Vendor	Product	Version / Range
asyncssh	asyncssh	to 2.23.1 (exc)
asyncssh	asyncssh	2.23.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in AsyncSSH version 2.23.0, a Python package implementing SSHv2 asynchronously. The issue is an incomplete fix for a previous vulnerability (CVE-2026-45309) in the SSHServerConfig._set_tokens function. While certain path tokens like /, , and .. are blocked before %u substitution in AuthorizedKeysFile, the fix does not block a leading ~ or ${ENV}. This omission allows these tokens to be expanded later in the code via _expand_val and Path(filename).expanduser(), enabling an attacker to escape the intended authorized-keys directory.

Impact Analysis

The vulnerability can allow an attacker to bypass directory restrictions on authorized SSH keys by using path expansions like ~ or environment variables (${ENV}). This could lead to unauthorized access or modification of SSH authorized keys outside the intended directory, potentially enabling privilege escalation or unauthorized SSH access.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade AsyncSSH to version 2.23.1 or later, where the issue is fixed.

Hi! I’m here to help you understand CVE-2026-54590. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70