VDB
CVE-2026-45309
CVE-2026-45309
PUBLISHED
CVSS 8.2 HIGH
Reported by GitHub_M · Published July 17, 2026
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0.
Risk Scores
CVSS 4.0
8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ronf | asyncssh | < 2.23.0 |
| ronf | asyncssh | < 2.23.0, < 2.23.0 |
| PyPI | asyncssh | 2.22.0 |
| chainguard | airflow-3 | 0, 0, 0 |
| wolfi | airflow-3 | 0, 0, 0 |
| chainguard | airflow-2 | 0 |
Timeline
- May 27, 2026 CVE Published
- May 28, 2026 Security Advisory
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 3, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
References
- https://github.com/ronf/asyncssh/security/advisories/GHSA-g794-3fmp-753h x_refsource_CONFIRM
- https://github.com/ronf/asyncssh/commit/2af2382cce946c959a378a62f257af253dc4ab51 x_refsource_MISC
- https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-45309 advisory
- https://github.com/advisories/GHSA-g794-3fmp-753h advisory