PyPI/asyncssh CVE-2026-45309: high 7.5, EPSS 0.59%

AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

Action: Upgrade asyncssh to 2.23.0 or later.

pip install asyncssh==2.23.0

Affected

Fixed versions

Sources

• osv: GHSA-g794-3fmp-753h
• nvd: CVE-2026-45309
• https://github.com/ronf/asyncssh/security/advisories/GHSA-g794-3fmp-753h
• https://github.com/ronf/asyncssh

CVE-2026-45309 · published 2026-05-27T21:35:06Z · modified 2026-09-10T03:50:47.025000862Z · JSON