CVE-2026-123037 Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)
Description
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.
CVSS 3.1 detail
Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:HExploitable with local access to the machine, with an ordinary account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Local
- Attack complexity
- High
- Privileges required
- Low
- Interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2 | Versions not published | |
| Red Hat Ansible Automation Platform Ansible Core 2 | Versions not published | |
| Self-service automation portal 2 | Versions not published | |
| Migration Toolkit for Applications 8 | Versions not published | |
| Migration Toolkit for Virtualization | Versions not published | |
| OpenShift Service Mesh 3 | Versions not published | |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Versions not published | |
| Red Hat Discovery 2 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published |
Show the 6 other branches Hide the 6 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat OpenShift Container Platform 5 | Versions not published | |
| Red Hat Satellite 6 | Versions not published | |
| Service Telemetry Framework 1.5 | Versions not published |