CVE-2026-54590: AsyncSSH Path Traversal Vulnerability

CVE-2026-54590 Overview

CVE-2026-54590 is a path traversal vulnerability [CWE-22] in AsyncSSH, a Python package that implements the SSHv2 protocol on top of the asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309. The SSHServerConfig._set_tokens function blocks /, \, and .. sequences before %u substitution in AuthorizedKeysFile, but fails to block a leading ~ or ${ENV} patterns. Later expansion in _expand_val and Path(filename).expanduser() allows attackers to escape the intended authorized-keys directory. The issue is fixed in version 2.23.1.

Critical Impact
A network-based attacker can influence authorized-keys path resolution to reference files outside the intended directory, potentially enabling authentication using attacker-controlled key material.

Affected Products

AsyncSSH version 2.23.0
Python applications embedding AsyncSSH as SSH server
Any deployment relying on the CVE-2026-45309 patch prior to 2.23.1

Discovery Timeline

2026-07-08 - CVE-2026-54590 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-54590

Vulnerability Analysis

AsyncSSH resolves the AuthorizedKeysFile configuration value through a multi-stage substitution process. The initial fix for CVE-2026-45309 introduced token filtering in SSHServerConfig._set_tokens to reject directory separators and parent-directory references before %u (username) substitution. The filter did not account for two additional expansion vectors: leading tilde (~) home-directory expansion and ${ENV} environment variable interpolation.

When a username or token contains ~ or ${VAR}, the unsafe characters survive the initial validation. Downstream calls to _expand_val and Path(filename).expanduser() then resolve these sequences into absolute filesystem paths outside the intended authorized-keys directory.

Root Cause

The root cause is incomplete input validation. The _unsafe_user_pattern regular expression in the original patch enumerated slash and dot-dot cases but omitted tilde and environment-variable syntax. The _env_pattern regex \${(.*)} also used greedy matching, further complicating safe expansion.

Attack Vector

Exploitation requires a network-reachable AsyncSSH server that uses username-templated AuthorizedKeysFile paths (for example, /etc/ssh/keys/%u/authorized_keys). An attacker supplies a crafted username containing ~ or ${...}. The server expands the value into an attacker-influenced path, causing key lookup against an unintended file that the attacker may control.

python

# Security patch in asyncssh/config.py (commit 3d515ba)
_token_pattern = re.compile(r'%(.)')
-_env_pattern = re.compile(r'\${(.*)}')
+_env_pattern = re.compile(r'\${(.*?)}')
+_unsafe_user_pattern = re.compile(r'^\.\.$|^~|^[A-Za-z]:|[/\\]|\$\{.*?\}')


def _exec(cmd: str) -> bool:
# Source: https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88

The patch expands _unsafe_user_pattern to reject leading ~, Windows drive letters ([A-Za-z]:), and ${...} environment variable references. The environment regex is also made non-greedy.

Detection Methods for CVE-2026-54590

Indicators of Compromise

SSH authentication attempts with usernames containing ~, ${, or backslash characters
Unexpected file reads targeting paths outside the configured authorized-keys directory
AsyncSSH server logs showing AuthorizedKeysFile resolution to unusual absolute paths
Successful authentications from accounts whose usernames include shell-metacharacter sequences

Detection Strategies

Enable verbose logging in AsyncSSH to capture the resolved AuthorizedKeysFile path per session
Inspect authentication logs for usernames not matching the expected [a-zA-Z0-9_-] character set
Monitor filesystem access on the SSH host for reads outside the designated key directory
Perform dependency scanning to identify Python environments still pinned to asyncssh==2.23.0

Monitoring Recommendations

Alert on SSH userauth-request packets containing tilde or dollar-brace sequences in the username field
Correlate SSH authentication events with process-level file open telemetry to detect traversal
Track outbound network traffic from accounts authenticated via AsyncSSH for post-auth anomalies

How to Mitigate CVE-2026-54590

Immediate Actions Required

Upgrade AsyncSSH to version 2.23.1 in all Python environments serving SSH
Audit AuthorizedKeysFile configuration values for use of %u and other tokens
Restrict accepted SSH usernames at the application or reverse-proxy layer to alphanumeric characters
Review authentication logs for suspicious username patterns since deploying version 2.23.0

Patch Information

The fix is available in AsyncSSH 2.23.1, released on GitHub. See the GitHub Release v2.23.1 and the GitHub Security Advisory GHSA-qr67-gv47-xwwh. The upstream commit is documented in the GitHub Commit Update.

Workarounds

Configure AuthorizedKeysFile without user-controlled token substitution where feasible
Enforce strict username validation before the SSH handshake reaches AsyncSSH
Run the AsyncSSH server process under a dedicated low-privilege account with limited filesystem access

bash

# Pin AsyncSSH to the patched release
pip install 'asyncssh>=2.23.1'

# Verify installed version
python -c "import asyncssh; print(asyncssh.__version__)"