What’s Vulnerable › Vulnerabilities

CVE-2026-11837: Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown

• Severity: high (CVSS 7.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-10 · updated 2026-10-29
• Weakness: CWE-59

Description

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.

Affected products

• Red Hat Enterprise Linux 10: all versions — fixed in 0:0.2.10-1.el10_2
• Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 0:0.2.3-6.el10_0.2
• Red Hat Enterprise Linux 8: all versions
• Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support: all versions — fixed in 0:0.1.8-2.el8_6.1
• Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On: all versions — fixed in 0:0.1.8-2.el8_6.1
• Red Hat Enterprise Linux 8.8 Telecommunications Update Service: all versions — fixed in 0:0.1.8-5.el8_8.1
• Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions: all versions — fixed in 0:0.1.8-5.el8_8.1
• Red Hat Enterprise Linux 9: all versions
• Red Hat OpenStack Platform 17.1: all versions

How to fix

Upgrade to a fixed version: Red Hat Enterprise Linux 10 0:0.2.10-1.el10_2; Red Hat Enterprise Linux 10.0 Extended Update Support 0:0.2.3-6.el10_0.2; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 0:0.1.8-2.el8_6.1; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 0:0.1.8-2.el8_6.1; Red Hat Enterprise Linux 8.8 Telecommunications Update Service 0:0.1.8-5.el8_8.1; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 0:0.1.8-5.el8_8.1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2026:42946
• https://access.redhat.com/errata/RHSA-2026:79112
• https://access.redhat.com/errata/RHSA-2026:80508
• https://access.redhat.com/errata/RHSA-2026:82339
• https://access.redhat.com/security/cve/CVE-2026-11837
• https://bugzilla.redhat.com/show_bug.cgi?id=2487424
• https://access.redhat.com/security/cve/CVE-2026-11837
• https://bugzilla.redhat.com/show_bug.cgi?id=2487424
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11837.json

Get alerted when CVE-2026-11837 or the next vulnerability affects your stack