CVE-2026-11837 Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown
Local attackers can escalate privileges by exploiting symlink handling in the Ansible authorized_key module to change ownership of arbitrary files.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-11837?
CVE-2026-11837 is a high-severity path traversal vulnerability in Red Hat Enterprise Linux 10, published on 10 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.
Weakness: CWE-59
Which versions are affected by CVE-2026-11837?
Linux distribution packages (7)
rhc-worker-playbook Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.2.3-6.el10_0.2 |
rhc-worker-playbook-debuginfo Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.2.3-6.el10_0.2 |
rhc-worker-playbook-debugsource Red Hat:enterprise_linux_eus:10.0 | All versions | 0:0.2.3-6.el10_0.2 |
rhc-worker-playbook Red Hat:rhel_aus:8.6::appstream | All versions | 0:0.1.8-2.el8_6.1 |
rhc-worker-playbook Red Hat:rhel_e4s:8.8::appstream | All versions | 0:0.1.8-5.el8_8.1 |
rhc-worker-playbook Red Hat:rhel_eus_long_life:8.6::appstream | All versions | 0:0.1.8-2.el8_6.1 |
rhc-worker-playbook Red Hat:rhel_tus:8.8::appstream | All versions | 0:0.1.8-5.el8_8.1 |
How do I fix CVE-2026-11837?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-11837 being exploited?
There is no known exploitation of CVE-2026-11837 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as DEBIAN-CVE-2026-11837, GHSA-49qh-h4vj-mrgf, RHSA-2026:79112, RHSA-2026:80508, RHSA-2026:82339, UBUNTU-CVE-2026-11837.