CVE-2026-89091— Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
Quick assessment
Affected
Red Hat Migration Toolkit for Applications 8
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 ansible-core 中发现了一个漏洞。当使用 命令安装集合（collection）时，归档提取器通过词法路径规范化（ ）来验证成员路径，而不是解析符号链接（ ），并且在创建符号链接类型的目录成员之前未执行任何包含性检查。攻击者可以构造一个恶意的集合 tarball，链式关联多个符号链接目录条目，使得后续文件成员被写入到预期目标目录之外。这使得攻击者能够通过诱使受害者安装恶意集合，以运行 的用户权限覆盖任意文件，从而导致控制节点上的代码执行。此漏洞绕过了对 CVE-2020-10691 的安全修复。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89091
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in ansible-core. When installing a collection with
`ansible-galaxy collection install`, the archive extractor validates member
paths using lexical path normalisation (os.path.abspath) instead of resolving
symbolic links (os.path.realpath), and it performs no containment check on
symlink-typed directory members before creating them. A crafted collection
tarball can chain symlink directory entries so that a subsequent file member is
written outside the intended destination directory. This allows an attacker who
can get a victim to install a malicious collection to overwrite arbitrary files
with the privileges of the user running ansible-galaxy, leading to code
execution on the control node. This is a bypass of the fix for CVE-2020-10691.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
在文件访问前对链接解析不恰当(链接跟随)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Migration Toolkit for Applications 8 | - |
cpe:/a:redhat:migration_toolkit_applications:8
|
|
| Red Hat | Migration Toolkit for Virtualization | - |
cpe:/a:redhat:migration_toolkit_virtualization:2
|
|
| Red Hat | OpenShift Service Mesh 3 | - |
cpe:/a:redhat:service_mesh:3
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | - |
cpe:/a:redhat:acm:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
II. Public POCs for CVE-2026-89091
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89091
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-89091 (1)
Same Patch Batch · Red Hat · 2026-10-08 · 9 CVEs total
| CVE-2026-93017 | 7.7 HIGH | Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and |
| CVE-2026-107466 | 6.1 MEDIUM | Flatpak-builder: local file exfiltration via `file |
| CVE-2026-107651 | 5.5 MEDIUM | Eog: eog: arbitrary code execution via heap buffer overflow in png metadata reader |
| CVE-2026-107445 | 5.4 MEDIUM | Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organizat |
| CVE-2026-107565 | 5.1 MEDIUM | Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow dat |
| CVE-2026-107604 | 4.9 MEDIUM | Keycloak-services: keycloak-services: view-clients role allows retrieval of active client |
| CVE-2026-107444 | 4.3 MEDIUM | Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization |
| CVE-2026-107623 | 4.3 MEDIUM | Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline |
IV. Related Vulnerabilities
Same vendor: Red Hat
-
CVE-2026-108119
Busybox: busybox: tar extraction-root escape via deferred sy -
CVE-2026-108093
Gimp: gimp: denial of service via null pointer dereference i -
CVE-2026-108063
Libhangul: null pointer dereference in hanja_new() when look -
CVE-2026-107935
Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary -
CVE-2026-107655
Cups: null pointer dereference via embedded job ticket comme
Same weakness: CWE-59
-
CVE-2026-108119
Busybox: busybox: tar extraction-root escape via deferred sy -
CVE-2026-107810
Nginx UI: Backup restore follows crafted symlinks into the l -
CVE-2026-107707
Intego Antivirus through 3.0.0.1 Local Privilege Escalation -
CVE-2026-107608
Improper link resolution in asset bundling output handling i -
CVE-2026-107578
Improper Link Resolution Before File Access ('Link Following
V. Comments for CVE-2026-89091
No comments yet