Is CVE-2026-123037 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123037 being exploited in the wild.

How severe is CVE-2026-123037?

Medium severity, with a CVSS score of 6.7, published 6 November 2026.

How is CVE-2026-123037 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-123037?

Check whether you run Ansible-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123037: Ansible user module privilege escalation via symlinked SSH directory

CVE-2026-123037 · Severity: medium · CVSS 6.7 · Published 2026-11-06

Ansible's user module, when configured to generate SSH keys, fails to properly validate symlinks in the .ssh directory. An attacker with an unprivileged account on a managed node can replace their .ssh directory with a symlink pointing to a root-writable location, causing Ansible to write SSH keys to arbitrary directories like /etc/cron.daily, leading to privilege escalation to root.

Vendors: Ansible.

Quick answers

Is CVE-2026-123037 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123037 being exploited in the wild.
How severe is CVE-2026-123037?: Medium severity, with a CVSS score of 6.7, published 6 November 2026.
Which products and versions are affected?: Ansible-Core <UNKNOWN>.
Is there a fix for CVE-2026-123037?: No fixed version is recorded yet. Do not use generate_ssh_key: yes against accounts whose home directory is controlled by untrusted users; pre-create ~/.ssh as a real directory owned appropriately before running the module, or generate the key as the target account itself (dropping to its uid/gid) rather than as root. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-123037 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-123037?: Check whether you run Ansible-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Do not use generate_ssh_key: yes against accounts whose home directory is controlled by untrusted users; pre-create ~/.ssh as a real directory owned appropriately before running the module, or generate the key as the target account itself (dropping to its uid/gid) rather than as root.

Technical details

The vulnerability exists in the user module's ssh_key_gen() function, which checks for symlinks on key files but uses os.path.exists() to validate the ~/.ssh directory itself—a check that follows symlinks. An attacker can replace ~/.ssh with a symlink to a root-writable directory; when the module runs with elevated privileges, it writes the generated key pair through the symlink and chown the files to the unprivileged user. This is an incomplete fix of CVE-2024-9902 and requires local access, an unprivileged account on the managed node, and subsequent execution of the user module with generate_ssh_key enabled.

Affected products

Ansible ansible-core <UNKNOWN>

Timeline

2026-11-06: disclosed
2026-11-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.