Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown
41Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 7.3epss 0.2%
from disclosure to weapon13 days
Published on NVDJun 10
1st PoC+13d
exploitation probability
0.2%top 94% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat OpenStack Platform 17.1Red Hat · Red Hat OpenStack Platform 18.0public PoCs found — 1
githubgithub.com/M8seven/cve-2026-11837-ansible-posix-authorized-key★ 1⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.