CVE-2026-54590: AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig.settokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in expandval and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AsyncSSHto a version that resolves this vulnerability.Fixed in 2.23.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54590?
CVE-2026-54590 has a medium severity level rated at 5.9.
How does CVE-2026-54590 affect AsyncSSH?
CVE-2026-54590 allows username substitution bypass through environment expansion, potentially leading to security risks.
What are the implications of CVE-2026-54590 in software security?
CVE-2026-54590 could enable unauthorized access under certain conditions due to incomplete mitigations.
How do I fix CVE-2026-54590?
To fix CVE-2026-54590, update to AsyncSSH version 2.23.1 or higher which addresses the vulnerability.
What is the primary vulnerability type for CVE-2026-54590?
The primary vulnerability type for CVE-2026-54590 is path traversal.