CVE-2026-123037: medium-severity vulnerability in Red Hat Migration Toolkit for Applications 8
Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.7epss 0.1%
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected products
Red Hat · Migration Toolkit for Applications 8Red Hat · Migration Toolkit for VirtualizationRed Hat · OpenShift Service Mesh 3Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2Red Hat · Red Hat Ansible Automation Platform 2Red Hat · Red Hat Ansible Automation Platform Ansible Core 2Red Hat · Red Hat Discovery 2Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat OpenShift Container Platform 4Red Hat · Red Hat OpenShift Container Platform 5Red Hat · Red Hat Satellite 6Red Hat · Self-service automation portal 2Red Hat · Service Telemetry Framework 1.5Related CVEs — Red Hat Migration Toolkit for Applications 8
In the same product, most dangerous first.
CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2025-8556LOWGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsEPSS 0.5%CVE-2026-89091HIGHAnsible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionEPSS 0.5%CVE-2026-92982HIGHAnsible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionEPSS 0.5%CVE-2025-11060MEDIUMSurrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptionsEPSS 0.3%CVE-2026-11332HIGHAnsible-core: argument injection in ansible-galaxy role install leads to arbitrary code executionEPSS 0.2%