CVE-2026-89091: 
Ansible vulnerability analysis and mitigation

CVE-2026-89091 is a symlink path traversal vulnerability in ansible-core that allows an attacker to overwrite arbitrary files on a control node by tricking a user into installing a malicious Ansible collection. The flaw exists in the ansible-galaxy collection install archive extractor, which uses lexical path normalization (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and performs no containment check on symlink-typed directory members. This is an explicit bypass of the prior fix for CVE-2020-10691. Affected software includes ansible-core and numerous Red Hat Ansible Automation Platform components (versions 2.4 through 2.7) across RHEL8/RHEL9. Disclosed on October 8, 2026, it carries a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, Github Advisory).

The root cause is classified as CWE-59 (Improper Link Resolution Before File Access / 'Link Following'). When ansible-galaxy extracts a collection tarball, it validates member paths using os.path.abspath — a lexical normalization that does not resolve symbolic links on disk — rather than os.path.realpath, which would follow and resolve symlinks to their true targets. Additionally, no containment check is performed on symlink-typed directory members before they are created. An attacker can craft a malicious collection tarball that chains multiple symlink directory entries, causing a subsequent file write to land outside the intended installation directory. The attack vector is network-based and requires user interaction (the victim must run ansible-galaxy collection install against the malicious collection), but requires no privileges from the attacker (Red Hat CVE, Github Advisory).

Successful exploitation allows an unauthenticated attacker to overwrite arbitrary files on the Ansible control node with the privileges of the user running ansible-galaxy, which in many environments is a privileged service account. This can lead to full code execution on the control node — a high-value target that typically has broad network access and credentials to managed infrastructure. All three security dimensions are critically impacted: confidentiality (access to sensitive files and secrets), integrity (arbitrary file modification), and availability (potential system disruption or destruction) (Red Hat CVE, Github Advisory).

As of the time of disclosure, no public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation (Github Advisory). The NVD SSVC assessment confirms exploitation status as "none" at this time. The EPSS score is approximately 0.48%, placing it in the 40th percentile for exploitation likelihood within 30 days. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability was discovered and reported by Parameter Autonomous Pentesting Agent (parameter.ai) (Red Hat CVE).

1. Craft a malicious collection tarball: Create an Ansible collection archive (.tar.gz) containing chained symlink directory entries. The first entry creates a symlink pointing to a directory outside the intended installation path (e.g., /tmp/evil -> /etc or a path leading to a writable system directory).
2. Chain symlink entries: Add additional symlink members that traverse through the first symlink, effectively escaping the destination directory boundary. Because ansible-galaxy uses os.path.abspath (lexical) rather than os.path.realpath (resolving), the path check is bypassed.
3. Embed a malicious file payload: Include a file member in the tarball whose resolved write path (after symlink traversal) targets a sensitive file — for example, a cron job file, SSH authorized_keys, a sudoers entry, or a Python library used by Ansible.
4. Distribute the malicious collection: Host the crafted collection on a public or private Ansible Galaxy-compatible server, or distribute it via social engineering (e.g., a GitHub repository, email, or internal artifact store).
5. Induce victim to install: Trick the target user or CI/CD pipeline into running ansible-galaxy collection install <malicious-collection>, triggering the vulnerable extraction logic.
6. Achieve code execution: The overwritten file (e.g., a cron script or Python module) executes with the privileges of the ansible-galaxy user, granting the attacker code execution on the control node and potential lateral movement to all managed hosts (Red Hat CVE, Github Advisory).

• File System: Unexpected files created or modified outside the Ansible collections installation directory (e.g., ~/.ansible/collections/); new or modified cron jobs, SSH authorized_keys, sudoers entries, or Python library files with recent timestamps coinciding with a collection install event.
• File System: Symlink files present within the extracted collection directory pointing to paths outside the collection root.
• Logs: Shell history or audit logs showing ansible-galaxy collection install commands referencing unfamiliar or external collection sources.
• Logs: File integrity monitoring (FIM) alerts for unexpected writes to /etc/, /root/, user home directories, or Python site-packages directories triggered around the time of an ansible-galaxy invocation.
• Process: Unexpected processes spawned by the user account that ran ansible-galaxy shortly after a collection install (e.g., reverse shells, curl/wget downloads, or new cron-triggered processes).
• Network: Outbound connections from the Ansible control node to unknown external IPs or domains following a collection installation event.

Red Hat has confirmed patches are available via the GitHub Advisory GHSA-4jhw-j7jr-j479; users should update ansible-core and all affected Ansible Automation Platform components (versions 2.4–2.7) to their patched releases as soon as they become available for their respective streams (Github Advisory, Red Hat CVE). As an interim workaround, restrict ansible-galaxy collection install to collections sourced exclusively from trusted, verified, and signed repositories. Consider running ansible-galaxy under a dedicated low-privilege service account to limit the blast radius of any file overwrite. Enabling file integrity monitoring (FIM) on sensitive directories of the control node can help detect exploitation attempts.

The vulnerability was credited to Parameter Autonomous Pentesting Agent (parameter.ai), an AI-driven security research tool, which is notable as an example of automated vulnerability discovery in widely-used open-source infrastructure software (Red Hat CVE). The flaw was included in coverage of Microsoft's October 2026 Patch Tuesday (which fixed over 1,400 flaws), drawing broader community attention to the scale of that release cycle. Social media activity was observed on Mastodon shortly after disclosure, and the CVE was picked up by multiple threat intelligence aggregators within hours of publication.