Description
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | — |
| Red Hat | Red Hat OpenStack Platform 18.0 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ansible | No fix yet | — |
| Debian 13 | ansible | No fix yet | — |
| Debian 12 | ansible | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ansible +1 | No fix yet | — |
| Ubuntu 26.04 LTS | ansible +1 | No fix yet | — |
| Ubuntu 25.10 | ansible +1 | No fix yet | — |
| Ubuntu 24.04 LTS | ansible +1 | No fix yet | — |
| Ubuntu 22.04 LTS | ansible-core | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 20.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ansible | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rhc-worker-playbook | 0.2.10-1.el10_2 | RHSA-2026:42946 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | rhc-worker-playbook | 0.2.3-6.el10_0.2 | RHSA-2026:79112 |
| RHEL 8.8 TUS | rhc-worker-playbook | 0.1.8-5.el8_8.1 | RHSA-2026:82339 |
| RHEL 8.8 E4S | rhc-worker-playbook | 0.1.8-5.el8_8.1 | RHSA-2026:82339 |
| RHEL 8.6 EUS Long Life | rhc-worker-playbook | 0.1.8-2.el8_6.1 | RHSA-2026:80508 |
| RHEL 8.6 AUS | rhc-worker-playbook | 0.1.8-2.el8_6.1 | RHSA-2026:80508 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ansible | 8.3.0-1.amzn2023.0.3 | ALAS2023-2026-1932 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
M8seven/cve-2026-11837-ansible-posix-authorized-key ★ 1 · Jun 23, 2026
CVE-2026-11837: local privilege escalation in the ansible.posix authorized_key module via symlink-following chown. Technical writeup; sibling of CVE-2024-9902.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 6
- RHSA-2026:42946 Red Hat Security Advisory: rhc-worker-playbook security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-3848 Red Hat Enterprise Linux (sssd, tftp, ansible-collection-ansible-posix): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- RHSA-2026:82339 Red Hat Security Advisory: rhc-worker-playbook security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:80508 Red Hat Security Advisory: rhc-worker-playbook security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:79112 Red Hat Security Advisory: rhc-worker-playbook security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- ALAS2023-2026-1932 Important: ansible security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jul 7, 2026
References
- RHSA-2026:42946 vendor-advisory
- RHSA-2026:79112 vendor-advisory
- RHSA-2026:80508 vendor-advisory
- RHSA-2026:82339 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-11837 vdb-entry
- RHBZ#2487424 issue-tracking