CVE-2024-9902: PYSEC-2026-1121 - ansible-core Incorrect Authorization vulnerability

CVE-2024-9902 · Severity: low · CVSS 3.1 · Published 2026-07-07

Ansible's user module, which is used to manage system user accounts and SSH keys across managed systems, contains an authorization flaw that allows unprivileged users to create or modify files and take ownership of them when a privileged user runs the module. If an unprivileged user can traverse directories, they can retain permanent control over files created through this vulnerability, potentially compromising system integrity and data security.

Technologies: ansible-core (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2024-9902 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-9902 being exploited in the wild.
How severe is CVE-2024-9902?
Low severity, with a CVSS score of 3.1, published 7 July 2026.
Which products and versions are affected?
ansible-core (PyPI) ECOSYSTEM:introduced=0,fixed=2.14.18rc1, ECOSYSTEM:introduced=0,fixed=2.14.18rc1,introduced=2.15.0b1,fixed=2.15.13rc1,introduced=2.16.0b1,fixed=2.16.13rc1,introduced=2.17.0b1,fixed=2.17.6rc1,introduced=2.18.0b1,fixed=2.18.0rc2.
Is there a fix for CVE-2024-9902?
Yes. ansible-core (PyPI): upgrade to 2.14.18rc1, 2.18.0rc2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-9902 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2024-9902?
Check whether you run ansible-core (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ansible-core (PyPI): upgrade to 2.14.18rc1, 2.18.0rc2 or later
    pip install "ansible-core>=2.18.0rc2"

Technical details

The vulnerability exists in ansible-core's user module, which improperly validates authorization when handling SSH key generation and file operations. An unprivileged user can exploit a directory traversal condition to cause a privileged user executing the user module against the unprivileged user's home directory to silently create, replace, or take ownership of arbitrary files on system paths. The flaw involves inadequate checks on SSH key file operations (ssh-keygen, chown, chmod), particularly when handling existing symlinked SSH public key files. Attack vector is local with low privileges required; exploitation typically requires the unprivileged user to have directory traversal permissions and a privileged Ansible user to execute the vulnerable module. Fixes are available in ansible-core versions 2.14.18+, 2.15.13+, 2.16.13+, 2.17.6+, and 2.18.0rc2+.

Affected products

  • Ansible ansible-core All versions before 2.14.18; 2.15.0 before 2.15.13; 2.16.0 before 2.16.13; 2.17.0 before 2.17.6; 2.18.0 before 2.18.0rc2

Identifiers

  • CVE-2024-9902
  • GHSA-32p4-gm2c-wmch
  • PYSEC-2026-1121

Timeline

  • 2024-11-06: disclosed
  • 2024-10-28: patched: Fixes committed to stable branches

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.