Executive brief
A security vulnerability exists in the Ansible POSIX collection, which is used to automate system configuration on Linux and Unix-like systems. An unprivileged user on a system can create deceptive file links (symbolic links) in their home directory to trick the automation tool into changing the ownership of sensitive system files. If an administrator runs an Ansible task to manage SSH keys for that user, the attacker could gain full administrative (root) control over the entire system.
Technical details
A local privilege escalation vulnerability exists in the `keyfile()` function of the `ansible.posix.authorized_key` module. The module incorrectly uses `os.chown()` instead of `os.lchown()` and fails to use the `O_NOFOLLOW` flag when opening files, leading to an improper link resolution (CWE-59) flaw. A local, unprivileged attacker can pre-stage symbolic links in their `~/.ssh` directory. When a privileged operator (root) runs an Ansible task using this module to manage that user's keys, the module follows the symlinks and changes the ownership of arbitrary system files to the attacker. This allows the attacker to modify sensitive files and escalate their privileges to root. This issue is a regression or sibling of CVE-2024-9902, which affected the ansible-core user module.
Affected products
- Red Hat ansible-collection-ansible-posix ansible.posix collection before fix
Timeline
- 2026-06-10: disclosed: Vulnerability reported and published in NVD