Bug 2567189 (CVE-2026-123037)

Summary: CVE-2026-123037 ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of CVE-2024-9902)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, brasmith, cahl, cochase, dpaolell, dranck, dschmidt, eglynn, ehelms, gparvin, jbalunas, jdelft, jjoyce, jlanda, jmitchel, jpasqual, jupierce, juwatts, jwong, kbempah, kshier, lblicha, lgarciaa, ljawale, mbiarnes, mburns, mgarciac, mhulan, mrunge, msilmser, ogajduse, osousa, ppalepu, ppostler, prdhamdh, rbobbitt, rchan, rhaigner, rhel-process-autobot, rjohnson, security-response-team, sghai, sidsharm, simaishi, smallamp, solenoci, stcannon, suppawar, tguha, tsze, vimartin, vlaad, watson-tool-maintainers, yguenane, zhunting
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-11-05 07:38:34 UTC 
When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists().