Security Flaw in Ansible-Core User Module Exposed to Privilege Escalation

CVE-2026-123037

What is CVE-2026-123037?

A flaw in the Ansible-Core user module can lead to potential privilege escalation. When the generate_ssh_key feature is active, the User.ssh_key_gen() function attempts to safeguard key files against symlink attacks. However, it only checks the ~/.ssh directory using os.path.exists(), which can be exploited by an unprivileged user on a managed node. By replacing their ~/.ssh directory with a symlink to a root-writable directory, these users can have the privileged module generate and write SSH key pairs through the symlink. This attack can enable unauthorized file drops into system directories processed by schedulers or the dynamic Message of the Day (MOTD), potentially granting the attacker root access on the managed node.

References