CVE-2026-89091 Path traversal in Migration Toolkit for Applications 8
A path traversal flaw in ansible-galaxy allows attackers to write arbitrary files and execute code by installing a malicious collection tarball.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-89091?
CVE-2026-89091 is a high-severity path traversal vulnerability in Red Hat Migration Toolkit for Applications 8, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.
Weakness: CWE-59
Which versions are affected by CVE-2026-89091?
Linux distribution packages (4)
ansible-core openSUSE:Tumbleweed | All versions | 2.21.5-2.1 |
ansible-core-2.18 openSUSE:Tumbleweed | All versions | 2.18.19-3.1 |
ansible-core-2.19 openSUSE:Tumbleweed | All versions | 2.19.14-2.1 |
ansible-core-2.20 openSUSE:Tumbleweed | All versions | 2.20.10-2.1 |
How do I fix CVE-2026-89091?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-89091 being exploited?
There is no known exploitation of CVE-2026-89091 in the wild and no public exploit code.
Sources
Also known as AZL-107132, DEBIAN-CVE-2026-89091, ECHO-118c-8b03-41a3, GHSA-4jhw-j7jr-j479, UBUNTU-CVE-2026-89091, openSUSE-SU-2026:12172-1 and 3 more.