netdev (>=0.9.1, <=0.9.3), pyplanet (>=0.7.0rc1, <=0.11.12) +2 more potentially affected by CVE-2026-54590 via asyncssh (1.18.0)

asyncssh PYPI version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - netdev =0.9.1, =0.7.0rc1, =0.0.1, =0.2.1 Source cves: CVE-2026-54590 Source advisory: OSV:GHSA-QR67-GV47-XWWH...

pyplanet (>=0.5.0, <=0.5.2) potentially affected by CVE-2026-54590 via asyncssh (1.11.0)

asyncssh PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - pyplanet =0.5.0, =0.5.2 Source cves: CVE-2026-54590 Source advisory: OSV:GHSA-QR67-GV47-XWWH...

CVE-2026-45309

A flaw was found in AsyncSSH, a Python package for SSHv2 protocol implementation. A remote attacker can exploit a path traversal vulnerability by manipulating the SSH username during pre-authentication. This allows the attacker to read sensitive authorized-keys files from unintended directories,...

Fedora 44 : python-asyncssh (2026-1f248487e4)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1f248487e4 advisory. update to version 2.24.0 Fix CVE-2026-54590: Unauthorized file modification via authorized-keys directory escape Fix CVE-2026-54591: Arbitrary file...

Fedora 43 : python-asyncssh (2026-574496d9ae)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-574496d9ae advisory. import asyncssh 2.23.1 Fix CVE-2026-54590: Unauthorized file modification via authorized-keys directory escape Fix CVE-2026-54591: Arbitrary file...

CVE-2026-45309

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py,...

CVE-2026-45309

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py,...

aiida-core (>=2.9.0rc0, <=2.9.2), grpc-pve-cloud (>=3.2.0, <=3.6.3rc0) +11 more potentially affected by CVE-2026-45309 via asyncssh (2.22.0)

asyncssh PYPI version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - aiida-core =2.9.0rc0, =3.2.0, =0.0.12, =3.1.0, =3.2.0, =3.1.0, =0.11.0, =0.1.4rc0, =0.2.0.dev14, =0.0.10, =0.0.12 - waldiez-runner 0.7.1 Source...

CVE-2026-45309 AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py,...

CVE-2026-45309

CVE-2026-45309 affects AsyncSSH prior to 2.23.0. Root cause: the OpenSSH-style token %u in AuthorizedKeysFile was expanded from the remote username without rejecting path separators or .. segments, letting a username such as with traversal characters read an attacker-controlled authorized-keys fi...

CVE-2026-45309 AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py,...

CVE-2026-45309 AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py,...

CVE-2026-45309

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py,...

CVE-2026-45309: Improper Limitation of a Pathname to a Restricted Directory

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py,...

PYSEC-2026-2384 AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

Summary AsyncSSH 2.22.0 expands the OpenSSH-compatible AuthorizedKeysFile %u token with the raw SSH username during pre-authentication server config reload. A server configured with a documented per-user key pattern such as AuthorizedKeysFile authorizedkeys/%u can be made to read an authorized-ke...

AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal username

SummaryAsyncSSH 2.22.0 expands the OpenSSH-compatible AuthorizedKeysFile %u token with the raw SSH username during pre-authentication server config reload. A server configured with a documented per-user key pattern such as AuthorizedKeysFile authorizedkeys/%u can be made to read an authorized-key...

aiida-core (>=2.9.0rc0, <=2.9.2), grpc-pve-cloud (>=3.2.0, <=3.6.3rc0) +11 more potentially affected by CVE-2026-45309 via asyncssh (2.22.0)

asyncssh PYPI version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - aiida-core =2.9.0rc0, =3.2.0, =0.0.12, =3.1.0, =3.2.0, =3.1.0, =0.11.0, =0.1.4rc0, =0.2.0.dev14, =0.0.10, =0.0.12 - waldiez-runner 0.7.1 Source...

PT-2026-59064

Summary AsyncSSH 2.22.0 expands the OpenSSH-compatible AuthorizedKeysFile %u token with the raw SSH username during pre-authentication server config reload. A server configured with a documented per-user key pattern such as AuthorizedKeysFile authorized keys/%u can be made to read an...

Linux Distros Unpatched Vulnerability : CVE-2026-54591

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...

Linux Distros Unpatched Vulnerability : CVE-2026-54590

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Versi...