CVE-2026-11837

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.

Score
CVSS 3.1 7.3 High
Status
Awaiting Analysis - secalert@redhat.com
Published
2026-06-10
Last modified
2026-10-13
Weaknesses
CWE-59

Affected products

References

 
 
© AVABIS GmbH privacypolicy about