Security Advisory catalog CVE-2026-11837
cve-program · CVE-2026-11837 Published
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.
Read the publisher's advisory Affected versions, risk and source history
cve-program · CVE-2026-11837 Published rhc-worker-playbook https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhc-worker-playbook",
"defaultStatus": "affected",
"versions": [
{
"version": "0:0.2.10-1.el10_2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
]
} rhc-worker-playbook https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhc-worker-playbook",
"defaultStatus": "affected",
"versions": [
{
"version": "0:0.2.3-6.el10_0.2",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
]
} rhc-worker-playbook https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhc-worker-playbook",
"defaultStatus": "affected",
"versions": [
{
"version": "0:0.1.8-2.el8_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
]
} rhc-worker-playbook https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhc-worker-playbook",
"defaultStatus": "affected",
"versions": [
{
"version": "0:0.1.8-2.el8_6.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
]
} rhc-worker-playbook https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhc-worker-playbook",
"defaultStatus": "affected",
"versions": [
{
"version": "0:0.1.8-5.el8_8.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
]
} rhc-worker-playbook https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhc-worker-playbook",
"defaultStatus": "affected",
"versions": [
{
"version": "0:0.1.8-5.el8_8.1",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
]
} rhel-system-roles https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhel-system-roles",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
} rhc-worker-playbook https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhc-worker-playbook",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
} rhel-system-roles https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhel-system-roles",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:8"
]
} rhc-worker-playbook https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhc-worker-playbook",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
} rhel-system-roles https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhel-system-roles",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
} ansible-collection-ansible-posix https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 17.1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-collection-ansible-posix",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
]
} ansible-collection-ansible-posix https://access.redhat.com/downloads/content/package-browser/
Publisher's version information Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "Red Hat",
"product": "Red Hat OpenStack Platform 18.0",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-collection-ansible-posix",
"defaultStatus": "unaffected",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
]
} Original source record · Cite this exact observation · Complete original publisher JSON