AsyncSSH: username path traversal in AuthorizedKeysFile %u lets an attacker pick the key file

Impact

Before 2.23.0, AsyncSSH expanded the OpenSSH-compatible %u token with the raw SSH username during pre-authentication config reload. A username containing /, \ or .. walks out of the intended directory, so an attacker can make the server load an authorized-keys file of their choosing and authenticate with a key they control - an authentication bypass against any service built on AsyncSSH that is configured with a relative pattern such as AuthorizedKeysFile authorized_keys/%u. This matters where a Python SSH front end sits in front of fleet tooling - jump and bastion services, network and node automation, SFTP endpoints for model and dataset transfer - because the bypass yields whatever that service does on the operator's behalf. Servers that do not use the %u token in AuthorizedKeysFile are not exposed; stock OpenSSH is unaffected.

Who can reach it

Network, pre-authentication: anyone who can open an SSH connection to an AsyncSSH-based server and choose their own username. No credentials needed, and it happens during config reload before authentication completes.

What to do

Upgrade the asyncssh dependency to 2.23.0 or later and restart the SSH service that embeds it - one daemon restart per service, no node work. Until then, stop using %u in AuthorizedKeysFile (point at a fixed path or supply keys programmatically) or reject usernames containing path separators and dot segments before they reach the config layer. Review auth logs for successful logins under usernames containing / , \ or ..

References

Related entries

• Linux kernel pKVM on arm64: host-supplied __hyp_running_vcpu pointer dereferenced at EL2CVE-2026-64286 · Linux kernel KVM arm64 pKVM (flush_hyp_vcpu context copy, __hyp_running_vcpu)High
• Linux kernel pKVM on arm64: unbounded host-supplied vGIC used_lrs indexes list registers at EL2CVE-2026-64287 · Linux kernel KVM arm64 pKVM (vGIC used_lrs bound in flush_hyp_vcpu)High
• Linux kernel (drivers/iommu/intel): A device that does not support ATS never gets inserted into the VT-d deviceCVE-2026-74355 · Linux kernel (drivers/iommu/intel)High
• Linux kernel (arch/x86/kvm/svm): If AVIC is inhibited while a nested guest is running, KVM leaves the x2APIC MSRsCVE-2026-74516 · Linux kernel (arch/x86/kvm/svm)High
• QEMU VAPIC hypercall lets a privileged guest write into locked SMRAM and run code in SMMCVE-2026-81627 · QEMU hw/i386/vapic.c (VAPIC setup hypercall, Q35/KVM)High
• Linux NFSD: NFSv2 SETATTR/CREATE useconds wrap to a bogus tv_nsec on 32-bit serversCVE-2026-89665 · Linux kernel NFSD (svcxdr_decode_sattr, NFSv2 useconds conversion)High