Is CVE-2026-89091 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-89091 being exploited in the wild.

How severe is CVE-2026-89091?

High severity, with a CVSS score of 8.8, published 8 October 2026.

Which products and versions are affected?

Red Hat ansible-core; Red Hat Ansible Automation Platform; Red Hat Enterprise Linux.

Is there a fix for CVE-2026-89091?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-89091 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-89091?

Check whether you run Red Hat Ansible Automation Platform, Red Hat Ansible-Core or Red Hat Enterprise Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-89091: Red Hat ansible-core path traversal in collection install

CVE-2026-89091 · Severity: high · CVSS 8.8 · Published 2026-10-08

Ansible-core is automation software used to manage enterprise infrastructure and deploy applications. When installing malicious collection packages via ansible-galaxy, attackers can exploit symbolic link handling to write arbitrary files anywhere on the system and execute code with the privileges of the user running the tool. This represents a significant risk to control nodes managing critical infrastructure.

Technologies: Red Hat Ansible Automation Platform, Red Hat Ansible-Core, Red Hat Enterprise Linux. Vendors: Red Hat.

Quick answers

Is CVE-2026-89091 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-89091 being exploited in the wild.
How severe is CVE-2026-89091?: High severity, with a CVSS score of 8.8, published 8 October 2026.
Which products and versions are affected?: Red Hat ansible-core; Red Hat Ansible Automation Platform; Red Hat Enterprise Linux.
Is there a fix for CVE-2026-89091?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89091 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-89091?: Check whether you run Red Hat Ansible Automation Platform, Red Hat Ansible-Core or Red Hat Enterprise Linux. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a path traversal flaw (CWE-59) in the ansible-galaxy collection installer: it validates member paths using lexical normalization (os.path.abspath) rather than resolving symbolic links (os.path.realpath), and does not check symlink containment before creation. An attacker crafting a malicious collection tarball can chain symlink directory entries to write files outside the intended extraction directory. This requires user interaction (victim must install a crafted collection) but gains arbitrary file write and code execution as the running user.

Affected products

Red Hat ansible-core
Red Hat Ansible Automation Platform
Red Hat Enterprise Linux

Timeline

2026-10-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.