CVE-2026-126644
Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory
- Low 3.9
Description
A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). When an unprivileged local user replaces their ~/.ssh directory with a symlink to a directory they do not own, and an operator subsequently runs the authorized_key task as root (a common provisioning pattern), the module resolves its path operations through the symlink: atomic_move() writes the temporary file in the symlink target and renames it to <target>/authorized_keys, creating or overwriting a file in the attacker-chosen directory, and os.chmod(sshdir, 0o700) follows the symlink and changes the target directory's permissions. The written file is chowned to the unprivileged user, so this is not a privilege escalation, but it allows an attacker to create or overwrite files (for example in /etc/apt/apt.conf.d/, which APT reads regardless of file ownership) to cause integrity and availability impacts.
Key facts
- Published
- 12 Nov 2026
- Last changed
- 13 Nov 2026
- Assigned by
- redhat
- EPSS
- 0.111% likely to be exploited in the next 30 days, higher than 1.364% of CVEs (scores for 15 Nov 2026)
- SSVC (CISA)
- Exploitation: none; Automatable: no; Technical impact: partial
Severity scores
Each score is shown as its source gave it. They are not averaged or merged.
- 3.9CVSS 3.1, Lowfrom the CNA (redhat)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
What to do
- Do not run ansible.posix.authorized_key as root against home or .ssh directories that unprivileged users can modify. Verify that target directories are not attacker-controllable symlinks before running the task.CNA workaround statement
Historical context and remediation
This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.
No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.
Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 |
|
| Red Hat | Red Hat Enterprise Linux 9 |
|
Timeline
- 11 Nov 2026 Reported to Red Hat.
- 11 Nov 2026 Made public.
- 12 Nov 2026 Published