CVE-2026-126644— Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory

Quick assessment

Affected

Red Hat Red Hat Enterprise Linux 10

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在集合的模块中发现了一个链接跟随漏洞，这是 CVE-2026-11837 修复措施的残留问题。该修复仅保护了路径的最终组件（即在函数中使用并设置，以及使用标志）。当未授权本地用户将其目录替换为指向其不拥有目录的符号链接，随后管理员以 root 身份运行任务（这是一种常见的配置部署模式）时，该模块会通过符号链接解析其路径操作：会将临时文件写入符号链接的目标目录，并将其重命名为，从而在攻击者指定的目录中创建或覆盖文件；同时，会跟随符号链接并修改目标目录的权限。虽然所写入的文件会被设置为未授权用

CVSS 3.9 · Low Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1565.001 · Stored Data Manipulation T1548.001 · Setuid and Setgid

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory

Source: CVE Program / CVE List V5

Vulnerability Description

A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). When an unprivileged local user replaces their ~/.ssh directory with a symlink to a directory they do not own, and an operator subsequently runs the authorized_key task as root (a common provisioning pattern), the module resolves its path operations through the symlink: atomic_move() writes the temporary file in the symlink target and renames it to <target>/authorized_keys, creating or overwriting a file in the attacker-chosen directory, and os.chmod(sshdir, 0o700) follows the symlink and changes the target directory's permissions. The written file is chowned to the unprivileged user, so this is not a privilege escalation, but it allows an attacker to create or overwrite files (for example in /etc/apt/apt.conf.d/, which APT reads regardless of file ownership) to cause integrity and availability impacts.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Source: CVE Program / CVE List V5

Vulnerability Type

在文件访问前对链接解析不恰当(链接跟随)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Red Hat	Red Hat Enterprise Linux 10	-	`cpe:/a:redhat:enterprise_linux:10`
Red Hat	Red Hat Enterprise Linux 9	-	`cpe:/a:redhat:enterprise_linux:9`

II. Public POCs for CVE-2026-126644

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126644

请登录查看更多情报信息。

Other References for CVE-2026-126644 (2)

https://access.redhat.com/security/cve/CVE-2026-126644 vdb-entry x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571732 issue-tracking x_refsource_REDHAT

https://www.cve.org/CVERecord?id=CVE-2026-126644

Same Patch Batch · Red Hat · 2026-11-12 · 5 CVEs total

CVE-2026-126643	6.5 MEDIUM	Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontrol
CVE-2026-126641	6.5 MEDIUM	Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabled
CVE-2026-126642	6.5 MEDIUM	Awx: webhook credential assignment omits use_role check, exposing another user's token
CVE-2026-71367	4.3 MEDIUM	Awx: websocket broadcast groups leak cross-organization job metadata

IV. Related Vulnerabilities

Same product: Red Hat Enterprise Linux 10

Same vendor: Red Hat

Same weakness: CWE-59