What is the CVSS score of CVE-2026-54590?

CVE-2026-54590 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-54590?

Yes, a patch is available for CVE-2026-54590. Update the affected software to the latest version immediately.

AsyncSSH CVE-2026-54590

EUVD-2026-42400 MEDIUM

Path Traversal (CWE-22)

2026-07-08 security-advisories@github.com

GHSA-qr67-gv47-xwwh

Python Path Traversal

5.9

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

5.9 MEDIUM

Attack complexity high due to specific config requirement; no confidentiality impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 27, 2026 - 11:00 vuln.today

Analysis Generated

Jul 08, 2026 - 22:21 vuln.today

Patch available

Jul 08, 2026 - 22:04 EUVD

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

28 pypi packages depend on asyncssh (9 direct, 19 indirect)

Ecosystem-wide dependent count for version 2.23.1.

DescriptionCVE.org

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig._set_tokens that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.

AnalysisAI

Path traversal vulnerability in AsyncSSH 2.23.0 allows an unauthenticated remote attacker to bypass the intended authorized-keys directory restriction. By supplying a malicious SSH username containing a tilde (~) or environment variable expansion (${ENV}), the attacker can write to arbitrary files, potentially gaining unauthorized SSH access. Public proof-of-concept exploit code exists, though exploitation is not widespread (EPSS 0.29%).

Technical ContextAI

AsyncSSH is an asynchronous SSHv2 implementation for Python's asyncio framework. The vulnerability is a path traversal (CWE-22) in the configuration parsing of the AuthorizedKeysFile directive. When %u substitution is used, the code expands the username via Path.expanduser(), which interprets tilde as a home directory reference and ${ENV} as an environment variable. The incomplete fix for CVE-2026-45309 blocked '/', '\', and '..' but not '~' or '${...}'. The affected CPE, if defined, would target python-asyncssh (though not provided in input).

RemediationAI

Upgrade to AsyncSSH version 2.23.1 immediately. The fix is available in the GitHub release https://github.com/ronf/asyncssh/releases/tag/v2.23.1 and via the commit https://github.com/ronf/asyncssh/commit/3d515ba9ba0cd9990d248bdf62bcf05d51261a88. As a workaround, if upgrading is not immediately feasible, avoid using %u substitution in AuthorizedKeysFile configuration, or ensure that only trusted usernames (e.g., pre-validated against a whitelist) are permitted to connect. However, disabling %u substitution may break legitimate authentication flows that rely on per-user authorized keys.