CVE-2026-45309: AsyncSSH Path Traversal Vulnerability Allows Unauthorized SSH Authentication
Summary
CVE-2026-45309: AsyncSSH 2.22.0 expands the OpenSSH-compatible AuthorizedKeysFile %u token with the raw SSH username during pre-authentication server config reload. Affects asyncssh versions >= 2.22.0, < 2.23.0. Fixed in 2.23.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AsyncSSH is a Python library that provides an asynchronous SSH client and server implementation. It is designed to be compatible with OpenSSH and is widely used for secure remote access and file transfer. The library supports various authentication methods, including public key authentication. However, a recent vulnerability has been identified that allows attackers to exploit the AuthorizedKeysFile configuration, leading to potential unauthorized access.
Vulnerability Detail
The vulnerability arises from the improper handling of the %u token in the AuthorizedKeysFile configuration. When the AsyncSSH server reloads its configuration, it expands this token using the raw SSH username without validating for path traversal characters such as .. or /. This oversight allows an attacker to place a malicious authorized-keys file outside the intended directory, enabling them to authenticate as a different user. The direct impact is that public-key authentication can succeed using an attacker-controlled key, compromising the security of the SSH server.
How To Fix
Latest published version: 2.24.1 as of 23 Oct 2026
pip install --upgrade "asyncssh==2.24.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.23.0
This is the first release that contains the fix.
pip install --upgrade "asyncssh==2.23.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the AuthorizedKeysFile configuration to avoid using the %u token or implement strict validation to reject usernames containing path traversal characters. For example, you can set a static path for authorized keys: AuthorizedKeysFile authorized_keys. Additionally, ensure that your application does not accept usernames with .., /, or \.
Conclusion
The AsyncSSH vulnerability CVE-2026-45309 poses a significant risk by allowing unauthorized SSH authentication through path traversal. It is crucial to update to the patched version or implement workarounds to secure your SSH server against potential attacks.
See every vulnerability recorded for asyncssh →
FAQ
CVE-2026-45309 is a vulnerability in AsyncSSH that allows attackers to authenticate using unauthorized public keys due to improper handling of the AuthorizedKeysFile configuration.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities in real-time.
The CVSS score of this vulnerability is 6.9, indicating a moderate level of risk.
If you cannot update AsyncSSH right away, implement the suggested workarounds to mitigate the risk until you can apply the patch.
More information about AsyncSSH can be found on its official GitHub repository and documentation, which provide details on its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for asyncssh.
