CVE catalog

CVE-2026-11837

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLL

[CVE catalog]

Severity
High · CVSS 7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.16% · Oct 25, 2026

A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianansiblesid14.4.0+dfsg-1vulnerable
Debianansibleforky14.0.0+dfsg-1vulnerable
Debianansibletrixie12.0.0+dfsg-0+deb13u1vulnerable
Debianansiblebookworm7.7.0+dfsg-3+deb12u1vulnerable
CpeansibleNot reportedNot reportedvulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianansiblesourcesid(unfixed)not yet assignedNot reported[1139917]
Debianansiblesourceforky(unfixed)not yet assignedNot reported[1139917]
Debianansiblesourcetrixie(unfixed)not yet assignedNot reported[1139917]
Debianansiblesourcebookworm(unfixed)not yet assignedNot reported[1139917]

[Debian bug #1139917]

Notes

[trixie] ansible: Minor issue [bookworm] ansible: Minor issue, can be fixed with next update

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ansible]Affected
    Details (2)

    • 7.7.0+dfsg-3+deb12u1 · all · bookworm

      Affected

      nvd · ansible · debian · bookworm

    • 7.7.0+dfsg-3+deb12u1 · all · bookworm

      Affected

      nvd · ansible · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]