Link Following Flaw in Ansible POSIX Collection by Red Hat
CVE-2026-126644

3.9LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126644?

A link-following vulnerability exists in the authorized_key module of the Ansible POSIX Collection. This flaw arises due to an incomplete fix from a previous vulnerability, where an unprivileged local user could replace their ~/.ssh directory with a symlink pointing to a directory they do not own. When the authorized_key task is executed with root privileges, it follows the symlink, allowing the attacker to create or overwrite key files in sensitive directories. This can lead to significant integrity and availability impacts, such as unauthorized changes to system configurations.

References

https://access.redhat.com/security/cve/CVE-2026-126644
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2571732
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.9
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.