CVE-2026-11837: Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown

Synopsis

A local privilege escalation vulnerability exists in the ansible.posix authorized_key module, part of the ansible-collection-ansible-posix package on Red Hat Enterprise Linux and Red Hat OpenStack Platform. The module's keyfile() function calls os.chown() instead of os.lchown() and opens files without the O_NOFOLLOW flag, allowing a low-privileged local user to pre-stage symbolic links in their ~/.ssh directory. When an operator runs the authorized_key task as root, the attacker redirects ownership changes to arbitrary system paths, gaining full local privilege escalation. No upstream fix has been published; HarborGuard tracks the advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access is required to reach the vulnerable code path.

• AuthenticationRequired

  Any low-privilege local account is sufficient; the attacker only needs a normal user session to pre-stage the symlink before the privileged Ansible task runs.

• Victim interactionRequired

  An operator (or automated process) must execute the authorized_key Ansible task as root, making the attack dependent on that privileged action occurring.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race condition, specific memory layout, or other environmental factors beyond the symlink being in place before the task runs.

Blast Radius

• Reads files owned by root or other privileged system users after redirecting chown, exposing sensitive credentials, keys, or configuration.
• Modifies ownership of arbitrary system paths such as /etc/passwd or /etc/shadow, enabling the attacker to write to those files and alter authentication configuration.
• Gains effective root-level access on the affected host, allowing installation of backdoors or further lateral movement within the environment.