Source: ansible Version: 14.0.0~a4+dfsg-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for ansible. CVE-2026-11837[0]: | A local privilege escalation vulnerability was found in the | ansible.posix authorized_key module. The module's keyfile() function | uses os.chown() instead of os.lchown() and opens files without | O_NOFOLLOW when managing SSH authorized keys. An unprivileged local | user can pre-stage symbolic links in their ~/.ssh directory to | redirect file ownership changes to arbitrary system paths when an | operator runs the authorized_key task as root, leading to local | privilege escalation. At time of writing this bugereport only the Red Hat reference was known, so might you check with upstream? If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-11837 https://www.cve.org/CVERecord?id=CVE-2026-11837 [1] https://bugzilla.redhat.com/show_bug.cgi?id=2487424 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
