CLEANSTART-2026-WV96741 Security fix for CVE-2026-45309 applied in: airflow-2 2.11.2-r2, airflow-3 3.1.8-r3, airflow-3 3.2.0-r0

CVE-2026-45309 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...

DEBIAN-CVE-2026-45309

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py,...

aiida-core (>=2.9.0rc0, <=2.9.2), grpc-pve-cloud (>=3.2.0, <=3.6.3rc0) +11 more potentially affected by CVE-2026-45309 via asyncssh (2.22.0)

asyncssh PYPI version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - aiida-core =2.9.0rc0, =3.2.0, =0.0.12, =3.1.0, =3.2.0, =3.1.0, =0.11.0, =0.1.4rc0, =0.2.0.dev14, =0.0.10, =0.0.12 - waldiez-runner 0.7.1 Source...

Linux Distros Unpatched Vulnerability : CVE-2026-45309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior...

DEBIAN-CVE-2026-54590

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig.settokens that blocks /, , and .. before %u substitution in...

UBUNTU-CVE-2026-54590

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig.settokens that blocks /, , and .. before %u substitution in...

PT-2026-56577

Name of the Vulnerable Software and Affected Versions AsyncSSH version 2.23.0 Description An incomplete fix in the SSHServerConfig. set tokens function fails to block leading or $ENV characters before %u substitution in the AuthorizedKeysFile. This allows subsequent expansion in expand val and...

CVE-2026-45309 vulnerabilities

Vulnerabilities for packages: airflow...

aiida-core (>=2.9.0rc0, <=2.9.2), grpc-pve-cloud (>=3.2.0, <=3.6.3rc0) +11 more potentially affected by CVE-2026-45309 via asyncssh (2.22.0)

asyncssh PYPI version 2.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on asyncssh and may be impacted: - aiida-core =2.9.0rc0, =3.2.0, =0.0.12, =3.1.0, =3.2.0, =3.1.0, =0.11.0, =0.1.4rc0, =0.2.0.dev14, =0.0.10, =0.0.12 - waldiez-runner 0.7.1 Source...