Vulnerability · Published Jun 10, 2026 · Assigned by redhat
CVE-2026-11837Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown
High 7.3
In plain English
A high-severity security flaw in Red Hat Enterprise Linux 10 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ansible | no fix listed | DEBIAN-CVE-2026-11837 |
| Debian:13 | ansible | no fix listed | DEBIAN-CVE-2026-11837 |
| Debian:14 | ansible | no fix listed | DEBIAN-CVE-2026-11837 |
| Ubuntu:24.04:LTS | ansible | no fix listed | UBUNTU-CVE-2026-11837 |
| Ubuntu:25.10 | ansible | no fix listed | UBUNTU-CVE-2026-11837 |
| Ubuntu:26.04:LTS | ansible | no fix listed | UBUNTU-CVE-2026-11837 |
| Ubuntu:26.10 | ansible | no fix listed | UBUNTU-CVE-2026-11837 |
| Ubuntu:22.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2026-11837 |
| Ubuntu:24.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2026-11837 |
| Ubuntu:25.10 | ansible-core | no fix listed | UBUNTU-CVE-2026-11837 |
| Ubuntu:26.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2026-11837 |
| Ubuntu:26.10 | ansible-core | no fix listed | UBUNTU-CVE-2026-11837 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | see references |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | see references |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | see references |
| Red Hat | Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions | see references |
| Red Hat | Red Hat Enterprise Linux 10 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 8 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat Enterprise Linux 9 | see references |
| Red Hat | Red Hat OpenStack Platform 17.1 | see references |
| Red Hat | Red Hat OpenStack Platform 18.0 | see references |
Weakness: CWE-59 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- RHSA-2026:42946 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:79112 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:80508 vendor-advisory, x_refsource_REDHAT
- RHSA-2026:82339 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2026-11837 vdb-entry, x_refsource_REDHAT
- RHBZ#2487424 issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11837.json x_sadp-csaf-vex