Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-07-17 | 2 | General2 |
| 2026-07-18 | 1 | Patch1 |
| 2026-08-27 | 1 | Disclosure1 |
🔴 AsyncSSH, Path Traversal Bypass, #CVE-2026-45309 (High) -DC-Aug2026-1962 https://dailycve.com/asyncssh-path-traversal-bypass-cve-2026-45309-high-dc-aug2026-1962/
Post summary
New CVE-2026-45309 disclosed for AsyncSSH, identified as a high‑severity path traversal bypass; no exploit or patch details are provided in the text.
🚨 HIGH - AsyncSSH AuthorizedKeysFile %u path traversal pre-auth bypass (CVE-2026-45309) AsyncSSH mishandles expansion of the OpenSSH-compatible AuthorizedKeysFile %u token during a pre-authentication server config reload, using the raw SSH username when building the authorized_keys path. The root cause is improper input validation leading to path traversal in username-based path construction. An attacker can exploit this remotely by supplying a crafted username containing traversal sequences (e.g., ../) when the server uses a per-user key pattern like AuthorizedKeysFile authorized_keys/%u, causing the server to read an authorized-keys file outside the intended directory and accept attacker-controlled keys. Impact is unauthorized authentication and potential full account compromise, enabling lateral movement and data access under the targeted user context. 👉 Affected: asyncssh < 2.23.0 | Upgrade to 2.23.0
Post summary
AsyncSSH is vulnerable to a path traversal that could allow remote unauthorized authentication; upgrading to version 2.23.0 resolves the issue.
🚨*CVE* CVE-2026-45309 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.… https://www.cve.org/CVERecord?id=CVE-2026-45309 ----- Traducción: CVE-2026-45309 Asy… http://infoflow.cloud`
Post summary
The post links to the CVE record and briefly describes AsyncSSH, but offers no technical details, exploitation evidence, or patch information—making it a general mention.
CVE-2026-45309 AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.… https://www.cve.org/CVERecord?id=CVE-2026-45309
Post summary
The passage merely references CVE-2026-45309 with a link to its CVE record, providing no substantial details on exploitation, patches, or technical specifics.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | asyncssh_project | asyncssh | - | - | - |