CVE-2026-54590: asyncssh Incomplete Fix Allows Unauthorized Access via Leading Tilde in AuthorizedKeysFile
Summary
CVE-2026-54590: Incomplete fix for CVE-2026-45309 (GHSA-g794-3fmp-753h). Affects asyncssh versions < 2.23.1. Fixed in 2.23.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
asyncssh is a Python library that provides an asynchronous SSH client and server implementation. It is widely used for secure shell access and file transfer over SSH. The library supports various features such as key authentication, SFTP, and SSH protocol version 2. However, a vulnerability has been identified in asyncssh that allows unauthorized access due to an incomplete fix for a previous issue.
Vulnerability Detail
The vulnerability arises from an incomplete fix for CVE-2026-45309, where the guard that sanitizes SSH usernames before substitution in the AuthorizedKeysFile does not block a leading tilde (~) or environment variable references (${ENV}). This oversight allows an attacker to bypass the intended directory restrictions and access authorized keys files outside the designated user directory. The primary vector for exploitation is through usernames like '~root', which can redirect the server to read unauthorized keys from an attacker's home directory.
How To Fix
Latest published version: 2.24.1 as of 23 Oct 2026
pip install --upgrade "asyncssh==2.24.1"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.23.1
This is the first release that contains the fix.
pip install --upgrade "asyncssh==2.23.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the leading tilde (~) or environment variable references in the usernames configured in the AuthorizedKeysFile directive. Ensure that the usernames do not contain any characters that could be exploited to bypass the guard.
Conclusion
The CVE-2026-54590 vulnerability in asyncssh poses a risk of unauthorized access due to an incomplete fix for a previous issue. It is crucial to update to the patched version to mitigate this risk and ensure secure SSH operations.
See every vulnerability recorded for asyncssh →
FAQ
CVE-2026-54590 is a vulnerability in the asyncssh library that allows unauthorized access due to an incomplete fix for a previous vulnerability, allowing attackers to bypass directory restrictions.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2026-54590 is 5.9, indicating a moderate severity level.
Update asyncssh to version 2.23.1 or later to secure your application against this vulnerability.
Yes, avoid using leading tildes (~) or environment variable references in usernames configured in the AuthorizedKeysFile directive as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for asyncssh.
