A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The keyfile() function uses os.chown() (not os.lchown()) and plain open() (no O_NOFOLLOW) when managing a user's ~/.ssh directory and authorized_keys file. An unprivileged local user can pre-stage symlinks in their ~/.ssh directory. When an operator runs the authorized_key task as root, the module follows the symlinks and changes ownership of arbitrary files/directories to the unprivileged user, enabling root escalation.

This is a sibling of CVE-2024-9902 (ansible-core user module), which addressed the same symlink-following class in generate_ssh_key. The authorized_key module in the separate ansible.posix collection was not covered by that fix.