CVE-2026-11837: 
Ansible vulnerability analysis and mitigation

CVE-2026-11837 is a local privilege escalation vulnerability in the ansible.posix Ansible collection's authorized_key module. The flaw allows an unprivileged local user to escalate privileges to root by pre-staging symbolic links in their ~/.ssh directory, which are then followed when an operator runs the authorized_key task as root. It was published on June 10, 2026, and is classified as High severity with a CVSS v3.1 base score of 7.3 (Red Hat CVE, GitHub Advisory). The affected product is the ansible-collection-ansible-posix package; specific patched versions have not yet been publicly listed (Red Hat Bugzilla).

The root cause is CWE-59 (Improper Link Resolution Before File Access — 'Link Following'). The keyfile() function within the ansible.posix authorized_key module uses os.chown() instead of os.lchown(), and opens files using a plain open() call without the O_NOFOLLOW flag when managing a user's ~/.ssh directory and authorized_keys file (Red Hat Bugzilla). Because symlinks are not detected or rejected, an unprivileged local user can pre-stage symlinks in their ~/.ssh directory pointing to arbitrary system paths; when the Ansible task runs as root, it follows the symlinks and changes ownership of those arbitrary paths to the unprivileged user, enabling privilege escalation. This vulnerability is described as a sibling of CVE-2024-9902 (ansible-core user module), which addressed the same symlink-following class in generate_ssh_key but did not cover the authorized_key module in the separate ansible.posix collection (Red Hat Bugzilla).

Successful exploitation allows an unprivileged local user to gain root-level ownership of arbitrary files and directories on the system, effectively achieving full local privilege escalation. The confidentiality, integrity, and availability impacts are all rated High, meaning an attacker could read sensitive system files, modify critical configurations, or disrupt system availability (GitHub Advisory). The attack is limited to the local system scope (Scope: Unchanged), but root compromise on a managed Ansible node could facilitate lateral movement across the broader infrastructure managed by the same Ansible control plane.

1. Reconnaissance: Identify a target system where Ansible's ansible.posix authorized_key module is used and tasks are executed as root by an operator.
2. Pre-stage symlinks: As an unprivileged local user, create or manipulate the ~/.ssh directory to contain symbolic links pointing to high-value system paths (e.g., ~/.ssh/authorized_keys -> /etc/passwd or ~/.ssh -> /etc/).
3. Wait for operator action: Wait for a privileged operator to run an Ansible playbook that invokes the authorized_key task targeting the unprivileged user's account, executing as root.
4. Trigger symlink following: When the task runs, the keyfile() function calls os.chown() on the symlink target (not the symlink itself, due to missing os.lchown()) and opens the file without O_NOFOLLOW, causing root to change ownership of the symlink's target path to the unprivileged user.
5. Achieve privilege escalation: With ownership of a critical system file (e.g., /etc/passwd, /etc/sudoers), the unprivileged user can modify it to grant themselves root access or add a backdoor account (Red Hat Bugzilla, GitHub Advisory).

• File System: Unexpected symbolic links in a user's ~/.ssh/ directory pointing to system paths outside the user's home directory (e.g., ~/.ssh/authorized_keys -> /etc/passwd).
• File System: Unexpected ownership changes on critical system files (e.g., /etc/passwd, /etc/sudoers, /etc/shadow) to non-root users.
• Logs: Ansible task logs showing authorized_key module execution as root against user accounts with unusual ~/.ssh directory structures.
• Logs: System audit logs (auditd) recording chown syscalls on sensitive system files initiated by the Ansible process (python, ansible).
• Process: Ansible worker processes (python) performing file ownership changes (chown) on paths outside expected user home directories.

Red Hat has acknowledged the vulnerability and a fix is tracked in Red Hat Bugzilla (Bug 2487424), but specific patched version numbers for ansible-collection-ansible-posix have not yet been publicly confirmed (Red Hat Bugzilla). As an immediate workaround, avoid running ansible.posix authorized_key tasks as root where possible, or restrict which users can have Ansible tasks run against their accounts. Operators should audit ~/.ssh directories for unexpected symlinks before executing authorized_key tasks with elevated privileges. Monitor the Red Hat CVE page and the GitHub Advisory for patch availability and apply updates as soon as they are released (Red Hat CVE, GitHub Advisory).

The vulnerability was reported to Red Hat via OSIDB and assigned high priority and severity in Red Hat Bugzilla (Red Hat Bugzilla). It was detected by Tenable's Nessus scanner (plugin 320361) shortly after disclosure, indicating rapid integration into vulnerability scanning tooling (Feedly). Social media activity was limited to automated CVE notification accounts, with no notable researcher commentary or broader community discussion observed at the time of reporting.