# CVE-2026-54590: ronf AsyncSSH path traversal in AuthorizedKeysFile username substitution

Source: https://junglewise.ai/threats/cve-2026-54590-ronf-asyncssh-path-traversal-in-authorizedkeysfile-username  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-54590 · Severity: medium · CVSS 5.9 · Published 2026-07-08

AsyncSSH's SSH server component re-evaluates the AuthorizedKeysFile configuration during user authentication. A previous patch added a guard to block path traversal attacks via username substitution, but the guard can be bypassed using special characters like tilde (~) or environment variable expansion that are processed after the guard runs, allowing an attacker to redirect authorized-keys file lookups to arbitrary home directories and potentially gain unauthorized SSH access if a victim's authorized-keys file contains the attacker's key.

Technologies: [asyncssh (PyPI)](https://junglewise.ai/threats/technologies/pypi-asyncssh). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-54590 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54590 being exploited in the wild.

**How severe is CVE-2026-54590?** Medium severity, with a CVSS score of 5.9, published 8 July 2026.

**Which products and versions are affected?** asyncssh (PyPI) ECOSYSTEM:introduced=0,fixed=2.23.1.

**Is there a fix for CVE-2026-54590?** Yes. asyncssh (PyPI): upgrade to 2.23.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54590 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-54590?** Check whether you run asyncssh (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- asyncssh (PyPI): upgrade to 2.23.1 or later

  ```sh
  pip install "asyncssh>=2.23.1"
  ```


## Technical details

The vulnerability is an incomplete fix for CVE-2026-45309. The original guard in SSHServerConfig._set_tokens (config.py:715-716) blocks SSH usernames containing forward slash, backslash, or equal to ".." before %u substitution in AuthorizedKeysFile. However, the substituted value is subsequently processed through environment-variable expansion and expanduser() at file-open time. The expanduser() function expands a leading tilde (~) to a user's home directory, and environment expansion can inject path separators. A username like "~root" passes the guard (no slashes), but after %u substitution and expanduser() expansion, the authorized-keys path is redirected to /root/.ssh/authorized_keys instead of the intended per-user location. The client-supplied username reaches this code path pre-authentication when _process_userauth_request reads the username from SSH_MSG_USERAUTH_REQUEST and calls reload_config() before key validation. Primary attack vector requires %u to be the leading path component in AuthorizedKeysFile; a secondary but weaker vector uses ${ENV} references to re-introduce slashes. Patch version 2.23.1 addresses this vulnerability.

## Affected products

- Ron Fredericksen asyncssh <=2.23.0

## Identifiers

- CVE-2026-54590
- GHSA-qr67-gv47-xwwh
- PYSEC-2026-3809

## Timeline

- 2026-06-16: disclosed: GitHub Advisory GHSA-qr67-gv47-xwwh published
- 2026-06-16: patched: Fixed in asyncssh 2.23.1
- 2026-08-26: advisory: Full technical advisory published

## References

- [https://api.github.com/users/cesabici-bit](https://api.github.com/users/cesabici-bit)
- [https://github.com/cesabici-bit](https://github.com/cesabici-bit)
- [https://api.github.com/users/cesabici-bit/gists%7B/gist_id%7D](https://api.github.com/users/cesabici-bit/gists%7B/gist_id%7D)
- [https://api.github.com/users/cesabici-bit/repos](https://api.github.com/users/cesabici-bit/repos)
- [https://avatars.githubusercontent.com/u/233045466?v=4](https://avatars.githubusercontent.com/u/233045466?v=4)
- [https://api.github.com/users/cesabici-bit/events%7B/privacy%7D](https://api.github.com/users/cesabici-bit/events%7B/privacy%7D)

## Related threats

- [AsyncSSH event-loop infinite loop via zero maximum packet size](https://junglewise.ai/threats/cve-2026-62949-asyncssh-event-loop-infinite-loop-via-zero-maximum-packet-size)
- [ronf AsyncSSH path traversal in AuthorizedKeysFile](https://junglewise.ai/threats/cve-2026-45309-ronf-asyncssh-path-traversal-in-authorizedkeysfile)
- [AsyncSSH path traversal in SCP client](https://junglewise.ai/threats/cve-2026-54591-asyncssh-path-traversal-in-scp-client)
- [AsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC](https://junglewise.ai/threats/asyncssh-vulnerable-to-prefix-truncation-attack-a-k-a-terrapin-attack-70e933b5)
- [AsyncSSH Rogue Session Attack](https://junglewise.ai/threats/cve-2023-46446-asyncssh-rogue-session-attack)