Executive brief
A vulnerability in the Ansible jailexec plugin allows an attacker with control over a FreeBSD jail to escape to the host system. By placing a malicious link inside the jail, an attacker can trick the host system into writing files to sensitive locations outside the jail during administrative tasks. This can lead to a complete takeover of the host server, potentially compromising all data and services running on that machine.
Technical details
The jailexec connection plugin's 'put_file' function (used by copy, template, and fetch tasks) incorrectly resolved destination paths on the host side rather than within the jail's chroot. Because the host-side 'mv' and 'mkdir' commands were executed with root privileges and followed symbolic links, an attacker inside the jail could create a symlink pointing to a host-side path (e.g., /etc/cron.d). When an Ansible task subsequently writes to that path, the host-side root process follows the link and writes the file to the host's filesystem. This allows for arbitrary file creation/overwrite on the host, leading to full privilege escalation. The issue is fixed in version 2.0.0 by performing all file operations inside the jail using 'jexec'.
Affected products
- chofstede ansible-jailexec < 2.0.0
Timeline
- 2026-06-10: patched: Fix included in version 2.0.0 release
- 2026-08-12: advisory: GitHub Advisory published