AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate with an attacker-selected key file. This issue is fixed in version 2.23.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2
    protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible
    AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and
    asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a
    server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the
    intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate
    with an attacker-selected key file. This issue is fixed in version 2.23.0. (CVE-2026-45309)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2     protocol on top of the Python asyncio framework. Prior to 2.23.0, AsyncSSH expands the OpenSSH-compatible     AuthorizedKeysFile %u token in asyncssh/config.py, asyncssh/connection.py, asyncssh/auth_keys.py, and     asyncssh/misc.py with the raw SSH username during pre-authentication server config reload, allowing a     server configured with AuthorizedKeysFile authorized_keys/%u to read an authorized-keys file outside the     intended directory when the SSH username contains /, \, or .. path traversal segments and authenticate     with an attacker-selected key file. This issue is fixed in version 2.23.0. (CVE-2026-45309)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
455513	Echo: asyncssh: security update to 2.23.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
455513	Echo: asyncssh: security update to 2.23.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
326315	Linux Distros Unpatched Vulnerability : CVE-2026-45309	Nessus	Misc.	Local	high
442396	SCA: security update for asyncssh (GHSA-g794-3fmp-753h)	Tenable Cloud Security	SCA Checks	Local	high
442396	SCA: security update for asyncssh (GHSA-g794-3fmp-753h)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-45309

high

Tenable Plugins

high

high

high

high

high