{"id":"CVE-2026-126644","kind":"vulnerability","aliases":["CVE-2026-126644"],"related":[],"title":"ansible.posix: authorized_key module follows symlinked ~/.ssh when run as root","description":"A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). When an unprivileged local user replaces their ~/.ssh directory with a symlink to a directory they do not own, and an operator subsequently runs the authorized_key task as root (a common provisioning pattern), the module resolves its path operations through the symlink: atomic_move() writes the temporary file in the symlink target and renames it to <target>/authorized_keys, creating or overwriting a file in the attacker-chosen directory, and os.chmod(sshdir, 0o700) follows the symlink and changes the target directory's permissions. The written file is chowned to the unprivileged user, so this is not a privilege escalation, but it allows an attacker to create or overwrite files (for example in /etc/apt/apt.conf.d/, which APT reads regardless of file ownership) to cause integrity and availability impacts.","summary":"The authorized_key module in the ansible.posix collection follows a symlink placed at a user's ~/.ssh path when run as root, so it writes or overwrites an authorized_keys file and changes permissions in a directory the attacker chooses. The file is chowned to the unprivileged user, so the impact is integrity and availability damage, such as planting files in /etc/apt/apt.conf.d/, rather than privilege escalation.","severity":"low","cvss":3.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ansible","ansible-posix","linux","package","provisioning"],"not_affected_if":["no-authorized-key-task","no-root-ansible-runs","single-user-hosts"],"how_to_check":"- Check whether the `ansible.posix` collection is installed and its version, for example with `ansible-galaxy collection list ansible.posix`.\n- Look for playbooks that run the `authorized_key` task with become/root against user home directories on shared or multi-user hosts.","fix":null,"status":"open","published_at":"2026-11-12T11:17:11+00:00","first_seen_at":"2026-11-12T11:38:05+00:00","triaged_at":"2026-11-12T11:40:07+00:00","updated_at":"2026-11-12T11:40:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T11:40:07Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"ansible.posix: authorized_key module follows symlinked ~/.ssh when run as root","impact":"medium","summary":"The authorized_key module in the ansible.posix collection follows a symlink placed at a user's ~/.ssh path when run as root, so it writes or overwrites an authorized_keys file and changes permissions in a directory the attacker chooses. The file is chowned to the unprivileged user, so the impact is integrity and availability damage, such as planting files in /etc/apt/apt.conf.d/, rather than privilege escalation.","audience":"developers","category":"package","nicknames":[],"who_cares":["ansible","ansible-posix","linux","provisioning"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker plants or overwrites files in chosen directories as root-run tasks","analyst_note":"Find the fixed ansible.posix version and the CVE-2026-11837 fix reference in the NVD entry or the ansible.posix changelog; the sources given do not state a fix.","how_to_check":"- Check whether the `ansible.posix` collection is installed and its version, for example with `ansible-galaxy collection list ansible.posix`.\n- Look for playbooks that run the `authorized_key` task with become/root against user home directories on shared or multi-user hosts.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["single-user-hosts","no-root-ansible-runs","no-authorized-key-task"],"who_is_affected":"Teams that run Ansible playbooks as root with the authorized_key task against user accounts on systems where local unprivileged users exist. Exposure requires a local attacker who can replace their own ~/.ssh with a symlink before the task runs; hosts with only trusted users and no shared local access are less exposed. The sources do not name a fixed version of ansible.posix.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000836,"input_tokens":4804,"output_tokens":711,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-11837':114C '-126644':14A,17A '-2026':13A,16A,113C '/.ssh':7A,41B,142C '/authorized_keys':192C '/etc/apt/apt.conf.d':86B,247C '0o700':207C 'allow':236C 'ansibl':18B,20B 'ansible-posix':19B 'ansible.posix':1A,31B,105C 'apt':249C 'atom':178C 'attack':63B,201C,238C 'attacker-chosen':200C 'author':2A,26B,53B,100C,160C 'avail':79B,259C 'caus':256C 'chang':57B,212C 'choos':64B 'chosen':202C 'chown':68B,222C 'collect':32B,106C 'common':166C 'compon':122C 'creat':193C,240C 'cve':12A,15A,112C 'damag':80B 'directori':61B,143C,149C,203C,215C 'escal':90B,233C 'exampl':245C 'fals':127C 'file':55B,66B,84B,183C,197C,220C,243C,253C 'final':120C 'fix':110C,116C 'flaw':95C 'follow':5A,33B,94C,125C,208C 'found':97C 'guard':117C 'impact':75B,260C 'integr':77B,257C 'key':3A,27B,54B,101C,161C 'link':93C 'link-follow':92C 'linux':22B 'local':138C 'modul':4A,28B,102C,170C 'move':179C 'nofollow':130C 'o':129C 'open':133C 'oper':156C,174C 'os.chmod':205C 'os.chown':123C 'overwrit':51B,195C,242C 'ownership':254C 'packag':23B 'path':42B,121C,173C 'pattern':168C 'permiss':58B,217C 'place':36B 'plant':83B 'posix':21B 'privileg':89B,232C 'provis':24B,167C 'rather':87B 'read':250C 'regardless':251C 'renam':189C 'replac':140C 'residu':107C 'resolv':171C 'root':11A,46B,164C 'run':9A,44B,158C 'safe':132C 'sshdir':206C 'subsequ':157C 'symlink':6A,35B,126C,146C,177C,186C,210C 'target':187C,214C 'task':162C 'temporari':182C 'unprivileg':71B,137C,225C 'user':39B,72B,139C,226C 'write':49B,134C,180C 'written':219C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Ansible playbooks as root with the authorized_key task against user accounts on systems where local unprivileged users exist. Exposure requires a local attacker who can replace their own ~/.ssh with a symlink before the task runs; hosts with only trusted users and no shared local access are less exposed. The sources do not name a fixed version of ansible.posix.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ansible","ansibleposix","linux","low","package","provisioning"],"campaign_type":null,"search_a":"'-126644':14A,17A '-2026':13A,16A '/.ssh':7A 'ansible.posix':1A 'author':2A 'cve':12A,15A 'follow':5A 'key':3A 'modul':4A 'root':11A 'run':9A 'symlink':6A","search_b":"'/.ssh':41B '/etc/apt/apt.conf.d':86B 'ansibl':18B,20B 'ansible-posix':19B 'ansible.posix':31B 'attack':63B 'author':26B,53B 'avail':79B 'chang':57B 'choos':64B 'chown':68B 'collect':32B 'damag':80B 'directori':61B 'escal':90B 'file':55B,66B,84B 'follow':33B 'impact':75B 'integr':77B 'key':27B,54B 'linux':22B 'modul':28B 'overwrit':51B 'packag':23B 'path':42B 'permiss':58B 'place':36B 'plant':83B 'posix':21B 'privileg':89B 'provis':24B 'rather':87B 'root':46B 'run':44B 'symlink':35B 'unprivileg':71B 'user':39B,72B 'write':49B","search_c":"'-11837':114C '-2026':113C '/.ssh':142C '/authorized_keys':192C '/etc/apt/apt.conf.d':247C '0o700':207C 'allow':236C 'ansible.posix':105C 'apt':249C 'atom':178C 'attack':201C,238C 'attacker-chosen':200C 'author':100C,160C 'avail':259C 'caus':256C 'chang':212C 'chosen':202C 'chown':222C 'collect':106C 'common':166C 'compon':122C 'creat':193C,240C 'cve':112C 'directori':143C,149C,203C,215C 'escal':233C 'exampl':245C 'fals':127C 'file':183C,197C,220C,243C,253C 'final':120C 'fix':110C,116C 'flaw':95C 'follow':94C,125C,208C 'found':97C 'guard':117C 'impact':260C 'integr':257C 'key':101C,161C 'link':93C 'link-follow':92C 'local':138C 'modul':102C,170C 'move':179C 'nofollow':130C 'o':129C 'open':133C 'oper':156C,174C 'os.chmod':205C 'os.chown':123C 'overwrit':195C,242C 'ownership':254C 'path':121C,173C 'pattern':168C 'permiss':217C 'privileg':232C 'provis':167C 'read':250C 'regardless':251C 'renam':189C 'replac':140C 'residu':107C 'resolv':171C 'root':164C 'run':158C 'safe':132C 'sshdir':206C 'subsequ':157C 'symlink':126C,146C,177C,186C,210C 'target':187C,214C 'task':162C 'temporari':182C 'unprivileg':137C,225C 'user':139C,226C 'write':134C,180C 'written':219C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T11:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126644","severity":null,"published_at":"2026-11-12T11:17:11+00:00","modified_at":"2026-11-12T11:17:11+00:00","first_seen_at":"2026-11-12T11:38:05+00:00","fetched_at":"2026-11-12T11:38:05+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}