Vulnerability Description
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Asyncssh Project | Asyncssh | < 2.23.0 |
Related Weaknesses (CWE)
References
- https://github.com/ronf/asyncssh/commit/2af2382cce946c959a378a62f257af253dc4ab51Patch
- https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88Patch
- https://github.com/ronf/asyncssh/security/advisories/GHSA-g794-3fmp-753hExploitVendor Advisory
- https://github.com/ronf/asyncssh/security/advisories/GHSA-g794-3fmp-753hExploitVendor Advisory
FAQ
What is CVE-2026-45309?
CVE-2026-45309 is a vulnerability with a CVSS score of 7.5 (HIGH). AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH...
How severe is CVE-2026-45309?
CVE-2026-45309 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-45309?
Check the references section above for vendor advisories and patch information. Affected products include: Asyncssh Project Asyncssh.