Bug 2487424 (CVE-2026-11837)

Summary: CVE-2026-11837 ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: eglynn, hsaito, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2487430, 2487431, 2487432    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-10 04:16:36 UTC 
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The keyfile() function uses os.chown() (not os.lchown()) and plain open() (no O_NOFOLLOW) when managing a user's ~/.ssh directory and authorized_keys file. An unprivileged local user can pre-stage symlinks in their ~/.ssh directory. When an operator runs the authorized_key task as root, the module follows the symlinks and changes ownership of arbitrary files/directories to the unprivileged user, enabling root escalation.

This is a sibling of CVE-2024-9902 (ansible-core user module), which addressed the same symlink-following class in generate_ssh_key. The authorized_key module in the separate ansible.posix collection was not covered by that fix.
Comment 4 Hideki Saito 2026-07-02 09:25:16 UTC 
It has been fixed below:

- https://github.com/ansible-collections/ansible.posix/pull/760

We have also released ansible.posix version 2.2.1, which includes this update.

- https://github.com/ansible-collections/ansible.posix/releases/tag/2.2.1