DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-54590: CVE-2026-54590: Path Traversal and Authentication Bypass in AsyncSSH via Username Token Substitution

#security #cve #cybersecurity

CVE-2026-54590: Path Traversal and Authentication Bypass in AsyncSSH via Username Token Substitution

Vulnerability ID: CVE-2026-54590
CVSS Score: 5.9
Published: 2026-08-26

An incomplete input sanitization fix in AsyncSSH version 2.23.0 allows unauthenticated remote attackers to bypass directory restriction controls and perform path-traversal attacks. When the system is configured to perform username token substitution inside its AuthorizedKeysFile directive, attackers can manipulate downstream path resolution mechanisms via tilde expansion and environment variable references. This flaw permits authentication bypasses by forcing the server to read public keys from unauthorized file locations outside the restricted environment.

TL;DR

An incomplete path-traversal fix in AsyncSSH allows unauthenticated remote attackers to escape AuthorizedKeysFile directories using tilde expansion and environment variable manipulation, enabling potential authentication bypass.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-22
  • Attack Vector: Network
  • CVSS: 5.9 (Medium)
  • EPSS Score: 0.00393
  • Impact: Integrity (High)
  • Exploit Status: Proof of Concept
  • KEV Status: Not Listed

Affected Systems

  • asyncssh Python package deployments
  • SSH servers utilizing dynamic AuthorizedKeysFile directories
  • asyncssh: <= 2.23.0 (Fixed in: 2.23.1)

Code Analysis

Commit: 3d515ba

Improve validation of username substitutions in config parameters

Exploit Details

  • GitHub Security Advisory: Advisory documenting the directory traversal bypass utilizing tilde expansion and environment variables

Mitigation Strategies

  • Upgrade the asyncssh Python package to version 2.23.1 or later
  • Avoid utilizing username token substitutions (%u) in AuthorizedKeysFile directives
  • Run the asyncssh application under an unprivileged user to limit path resolution scopes
  • Enforce container isolation or a read-only host filesystem

Remediation Steps:

  1. Identify all deployments using asyncssh version 2.23.0
  2. Execute 'pip install --upgrade asyncssh>=2.23.1' in the target python environment
  3. Audit active configuration templates to verify AuthorizedKeysFile paths
  4. Restart the affected SSH daemon service to apply the updated validation code

References

Read the full report for CVE-2026-54590 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)