CVE-2026-123037 · Package
NO FIX YET
When the Ansible user module generates SSH keys, it checks the ~/.ssh directory only for existence, not for symlinks. A local unprivileged user on a managed node can redirect the write to a root-writable directory and gain root.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Exposure requires the ansible-core user module running with generate_ssh_key enabled on a managed node where an unprivileged local user can log in. Systems that never run that module with key generation, or where no local untrusted users exist, are less exposed. The sources do not name specific affected version ranges.
Not affected if generate-ssh-key-disabled, no-local-untrusted-users
Who cares ansible-core, linux, self-hosted
ansible-core --version on managed nodes and controllers.user module with generate_ssh_key: true in playbooks.No fix yet, per the sources.
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.