CVE-2026-54590 AsyncSSH AuthorizedKeysFile username substitution bypass through ~ and environment expansion
Attackers can bypass authorized keys directory restrictions via tilde or environment variable expansion in AsyncSSH, potentially reading sensitive files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54590?
CVE-2026-54590 is a medium-severity path traversal vulnerability in ronf asyncssh, published on 8 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.
Which versions are affected by CVE-2026-54590?
3 open source packages ship an affected version, including asyncssh.
| Package | Affected | Fixed in |
|---|---|---|
asyncssh PyPI | All versions | 2.23.1 |
asyncssh PyPI | All versions | 2.23.1 |
asyncssh PyPI | All versions | 2.23.1 |
How do I fix CVE-2026-54590?
Upgrade asyncssh to 2.23.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54590 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54590 exists.
Sources
Also known as CLEANSTART-2026-IL04203, DEBIAN-CVE-2026-54590, ECHO-3b00-f8ea-bea7, GHSA-qr67-gv47-xwwh, MINI-56v4-gf5f-fxwp, MINI-c428-pwrv-rr6c and 3 more.