CVE-2026-45309 Details
Description
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0.
A path traversal vulnerability has been identified in AsyncSSH, a Python package that implements the SSHv2 protocol asynchronously using the asyncio framework. This vulnerability exists in versions of AsyncSSH prior to 2.23.0. The issue arises because, during the pre-authentication server configuration reload, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile '%u' token with the raw SSH username. If the username contains path traversal segments, the server can be tricked into reading an authorized keys file from outside the intended directory. This allows an attacker to authenticate using a key of their choice. The vulnerability is present in the AsyncSSH server configuration reload and public-key authentication components, specifically within the 'asyncssh/config.py', 'asyncssh/connection.py', 'asyncssh/auth_keys.py', and 'asyncssh/misc.py' files.
Users can upgrade to AsyncSSH version 2.23.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| asyncssh project asyncssh | < 2.23.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |