A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Redhat |
|
No data.
No data.
References
History
Sat, 07 Nov 2026 07:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Fri, 06 Nov 2026 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat acm
Redhat discovery Redhat enterprise Linux Redhat migration Toolkit Applications Redhat migration Toolkit Virtualization Redhat openshift Redhat satellite Redhat service Mesh Redhat stf |
|
| CPEs | cpe:/a:redhat:acm:2 cpe:/a:redhat:discovery:2::el8 cpe:/a:redhat:enterprise_linux:10 cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/a:redhat:migration_toolkit_applications:8 cpe:/a:redhat:migration_toolkit_virtualization:2 cpe:/a:redhat:openshift:4 cpe:/a:redhat:openshift:5 cpe:/a:redhat:satellite:6 cpe:/a:redhat:service_mesh:3 cpe:/a:redhat:stf:1.5 |
|
| Vendors & Products |
Redhat acm
Redhat discovery Redhat enterprise Linux Redhat migration Toolkit Applications Redhat migration Toolkit Virtualization Redhat openshift Redhat satellite Redhat service Mesh Redhat stf |
Fri, 06 Nov 2026 05:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Title | ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of CVE-2024-9902) | Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902) |
| First Time appeared |
Redhat
Redhat ansible Automation Platform Redhat ansible Core Redhat ansible Portal |
|
| CPEs | cpe:/a:redhat:ansible_automation_platform:2 cpe:/a:redhat:ansible_core:2 cpe:/a:redhat:ansible_portal:2 |
|
| Vendors & Products |
Redhat
Redhat ansible Automation Platform Redhat ansible Core Redhat ansible Portal |
|
| References |
|
Thu, 05 Nov 2026 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902. | |
| Title | ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of CVE-2024-9902) | |
| Weaknesses | CWE-59 | |
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2026-11-06T05:38:54.180Z
Updated: 2026-11-06T18:36:44.257Z
Reserved: 2026-11-05T07:01:01.186Z
Link: CVE-2026-123037
Vulnrichment
Updated: 2026-11-06T17:36:40.367Z
NVD
Status : Awaiting Analysis
Published: 2026-11-06T06:16:42.243
Modified: 2026-11-06T19:17:43.910
Link: CVE-2026-123037
Redhat