Read the docs
TI-2026-39424 Aliases CVE-2026-54590GHSA-qr67-gv47-xwwh

AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion

Priority MEDIUM 60CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00336 27th percentileScored 2026-11-07
Fix Fixed asyncssh (ronf): 2.23.1asyncssh (PyPI): 2.23.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ronfasyncsshbefore 2.23.12.23.1Patch availableCNA
—asyncssh (PyPI)before 2.23.12.23.1Patch availableGHSA-qr67-gv47-xwwh
  • asyncssh Vendorronf Affected before 2.23.1 Fixed in 2.23.1 Patch available CNA
  • asyncssh (PyPI) Vendor— Affected before 2.23.1 Fixed in 2.23.1 Patch available GHSA-qr67-gv47-xwwh

Remediation

  • Fix · CNA asyncssh (ronf) Fixed in 2.23.1
  • Fix · GHSA-qr67-gv47-xwwh asyncssh (PyPI) Fixed in 2.23.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-54590
  2. 2026-10-03 Alias added: GHSA-qr67-gv47-xwwh

References

Advisory 1

Other 4

  • TI-2026-39425 AsyncSSH: SCP Path Traversal to Arbitrary File Write CVSS 3.1HIGH 8.1
  • TI-2026-44984 AsyncSSH: asyncio event-loop freeze via SSH maximum packet size = 0 in SSH_MSG_CHANNEL_OPEN / OPEN_CONFIRMATION CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences