PyPI/asyncssh CVE-2026-45309: high 7.5, EPSS 0.59%

AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

Action: Upgrade asyncssh to 2.23.0 or later.

pip install asyncssh==2.23.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2384
• nvd: CVE-2026-45309
• https://github.com/ronf/asyncssh/security/advisories/GHSA-g794-3fmp-753h
• https://github.com/ronf/asyncssh
• https://pypi.org/project/asyncssh
• https://github.com/advisories/GHSA-g794-3fmp-753h

CVE-2026-45309 · published 2026-07-13T15:19:12.785321Z · modified 2026-07-13T16:31:31.297854793Z · JSON