CVE-2026-54590: ronf AsyncSSH path traversal in AuthorizedKeysFile username substitution

CVE-2026-54590 · Severity: medium · CVSS 5.9 · Published 2026-07-08

AsyncSSH's SSH server component re-evaluates the AuthorizedKeysFile configuration during user authentication. A previous patch added a guard to block path traversal attacks via username substitution, but the guard can be bypassed using special characters like tilde (~) or environment variable expansion that are processed after the guard runs, allowing an attacker to redirect authorized-keys file lookups to arbitrary home directories and potentially gain unauthorized SSH access if a victim's authorized-keys file contains the attacker's key.

Technologies: asyncssh (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-54590 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54590 being exploited in the wild.
How severe is CVE-2026-54590?
Medium severity, with a CVSS score of 5.9, published 8 July 2026.
Which products and versions are affected?
asyncssh (PyPI) ECOSYSTEM:introduced=0,fixed=2.23.1.
Is there a fix for CVE-2026-54590?
Yes. asyncssh (PyPI): upgrade to 2.23.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54590 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-54590?
Check whether you run asyncssh (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • asyncssh (PyPI): upgrade to 2.23.1 or later
    pip install "asyncssh>=2.23.1"

Technical details

The vulnerability is an incomplete fix for CVE-2026-45309. The original guard in SSHServerConfig._set_tokens (config.py:715-716) blocks SSH usernames containing forward slash, backslash, or equal to ".." before %u substitution in AuthorizedKeysFile. However, the substituted value is subsequently processed through environment-variable expansion and expanduser() at file-open time. The expanduser() function expands a leading tilde (~) to a user's home directory, and environment expansion can inject path separators. A username like "~root" passes the guard (no slashes), but after %u substitution and expanduser() expansion, the authorized-keys path is redirected to /root/.ssh/authorized_keys instead of the intended per-user location. The client-supplied username reaches this code path pre-authentication when _process_userauth_request reads the username from SSH_MSG_USERAUTH_REQUEST and calls reload_config() before key validation. Primary attack vector requires %u to be the leading path component in AuthorizedKeysFile; a secondary but weaker vector uses ${ENV} references to re-introduce slashes. Patch version 2.23.1 addresses this vulnerability.

Affected products

  • Ron Fredericksen asyncssh <=2.23.0

Identifiers

  • CVE-2026-54590
  • GHSA-qr67-gv47-xwwh
  • PYSEC-2026-3809

Timeline

  • 2026-06-16: disclosed: GitHub Advisory GHSA-qr67-gv47-xwwh published
  • 2026-06-16: patched: Fixed in asyncssh 2.23.1
  • 2026-08-26: advisory: Full technical advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.