CVE-2026-54590: AsyncSSH Path Traversal in SSH Authorized Keys File Handling

Technical summary

CVE-2026-54590 is a path traversal flaw in AsyncSSH's SSHServerConfig._set_tokens method. The vulnerability stems from incomplete input sanitization in the AuthorizedKeysFile parameter. While the code removes forward slashes, commas, and double dots before the %u substitution placeholder, it does not filter leading tilde (~) characters or environment variable expressions (${ENV}). During subsequent processing in _expand_val and Path(filename).expanduser(), these unfiltered sequences are expanded by Python's path resolution functions, allowing directory escape. The attack relies on the tilde expansion to reference home directories or environment variables outside the intended authorized-keys directory scope. This is an incomplete fix for the earlier CVE-2026-45309, which addressed similar issues but did not account for all expansion vectors.

Business impact

A successful exploitation of this vulnerability could allow unauthorized SSH server operators or network-adjacent attackers to enumerate or exfiltrate SSH public key material stored outside the intended authorized-keys directory. While the CVSS score reflects medium severity, the business impact depends on deployment context. Organizations running AsyncSSH as an SSH server where untrusted users can influence the AuthorizedKeysFile configuration face the greatest risk. Compromise of SSH keys can lead to lateral movement, persistent access, or identity spoofing within infrastructure environments. The impact is limited by the requirement for high attack complexity and the fact that integrity rather than confidentiality is the primary concern in the CVSS vector.

Affected systems

AsyncSSH version 2.23.0 is the only version confirmed affected by this vulnerability. Any system running this specific version of AsyncSSH, particularly those using it as an SSH server implementation in Python-based applications, requires immediate patching. The vulnerability is applicable across all platforms where AsyncSSH 2.23.0 is deployed (Linux, Windows, macOS, etc.). Organizations should verify whether AsyncSSH is used as a dependency in their SSH server implementations, secure shell proxy solutions, or custom SSH tooling. Version 2.23.1 and later versions contain the fix and should be targeted.

Exploitability

Exploitation requires network access to an AsyncSSH SSH server running version 2.23.0. The attacker must craft an SSH authentication attempt with a specially constructed authorized keys file path containing tilde or environment variable syntax. The high attack complexity (AC:H in the CVSS vector) reflects the requirement to manipulate or predict the AuthorizedKeysFile path in a meaningful way. The attack does not require authentication or user interaction. While not currently in CISA's Known Exploited Vulnerabilities catalog, the relative simplicity of path traversal exploitation and the clear technical vector suggest this could become practically exploited once public details emerge. No public exploit code is known to exist at this time.

Remediation

Immediate action: Upgrade AsyncSSH from version 2.23.0 to version 2.23.1 or later. This is the definitive fix and should be prioritized for all systems running the affected version. Before upgrading, verify that the newer version is compatible with your application and dependencies. Test the upgrade in a non-production environment first, as SSH infrastructure changes can be disruptive. Additionally, review SSH server configurations to minimize the exposure of AuthorizedKeysFile paths to untrusted input sources. If running older versions of AsyncSSH, ensure you are not also affected by CVE-2026-45309, which this fix was intended to address.

Patch guidance

Update AsyncSSH to version 2.23.1 or later through your package management system (pip, conda, or your distribution's package manager). Verify the update using pip show asyncssh or equivalent tooling to confirm version 2.23.1 is installed. No manual configuration changes are required after patching; the fix is purely code-level. Test SSH connectivity and key-based authentication immediately after patching to ensure no disruption. If you have custom SSH server implementations built on AsyncSSH, ensure they are redeployed with the patched library. Check upstream projects or frameworks that may bundle AsyncSSH (if any) for their own release schedules.

Detection guidance

Log analysis: Search SSH server logs for authentication attempts with unusual AuthorizedKeysFile parameters containing tilde (~) or ${...} syntax, particularly if they differ from expected configuration. Network detection: Monitor for SSH authentication attempts with crafted key file paths or environment variable references. Source code review: Examine AuthorizedKeysFile configuration in any custom AsyncSSH implementations to identify potential tilde or variable expansion issues. Dependency scanning: Use Software Composition Analysis (SCA) tools to identify AsyncSSH 2.23.0 in your codebase. If detected, it should trigger an immediate patching workflow. Consider proactive testing in a sandbox environment to confirm your AsyncSSH deployment is vulnerable before public exploits surface.

Why prioritize this

While the CVSS score of 5.9 (MEDIUM) reflects moderate severity, this vulnerability should be prioritized for rapid patching because: (1) it is an incomplete fix for a prior path traversal issue, suggesting security fundamentals were overlooked; (2) path traversal vulnerabilities are well-understood and relatively easy to exploit once technical details emerge; (3) SSH key material is high-value target data in infrastructure environments; (4) the fix is straightforward (version upgrade) with no backward compatibility concerns noted; (5) not yet in KEV but likely to be added once public awareness grows. Organizations running AsyncSSH as a production SSH server should treat this as a near-critical priority for patch deployment within 48–72 hours.

Risk score, explained

The CVSS 3.1 score of 5.9 (MEDIUM) is driven by: High Impact on Integrity (the I:H component) — unauthorized access to SSH keys violates confidentiality of authentication material; No Impact on Confidentiality or Availability (C:N, A:N) — the vulnerability does not directly expose other data or interrupt service; High Attack Complexity (AC:H) — requires crafted input and specific path manipulation; Network-based (AV:N) — exploitable remotely via SSH protocol; No Privilege Requirement (PR:N) and No User Interaction (UI:N). The MEDIUM rating appropriately reflects that exploitation is plausible but requires specific conditions. In practical terms, the impact of SSH key compromise in an active infrastructure environment may be higher than the score suggests, warranting risk-context adjustment during prioritization.

Frequently asked questions