CVE-2026-123037
Full vulnerability record from the local CVENow database.
Description
A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.
Severity
MEDIUM
CVSS score
6.7
(v3.1)
Vulnerability status
Awaiting Analysis
Source identifier
Published
2026-11-06 06:16:42.243000
Last modified
2026-11-06 06:16:42.380000
View original CVE JSON
{
"id": "CVE-2026-123037",
"sourceIdentifier": "[email protected]",
"published": "2026-11-06T06:16:42.243",
"lastModified": "2026-11-06T06:16:42.380",
"vulnStatus": "Awaiting Analysis",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-24/hub-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-24/lightspeed-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/controller-rhel8-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/de-minimal-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/de-supported-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/eda-controller-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/eda-controller-rhel8-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/ee-minimal-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/ee-minimal-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/ee-supported-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/ee-supported-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/gateway-rhel8-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/hub-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/hub-rhel8-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/lightspeed-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/lightspeed-rhel8-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/platform-resource-rhel8-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-25/platform-resource-runner-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/controller-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/de-minimal-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/de-supported-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/eda-controller-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/eda-controller-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/ee-minimal-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/ee-supported-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/gateway-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/hub-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/hub-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/lightspeed-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/lightspeed-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/platform-resource-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-26/platform-resource-runner-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/aap-cloud-billing-operator-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/controller-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/de-minimal-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/de-supported-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/eda-controller-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/eda-controller-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/ee-minimal-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/ee-supported-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/gateway-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/hub-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/hub-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/lightspeed-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/lightspeed-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/metrics-service-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/platform-resource-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-27/platform-resource-runner-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-tech-preview/ansible-devspaces-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-tech-preview/metrics-service-rhel9-operator",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-core",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform/ee-minimal-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform/ee-minimal-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-tech-preview/ee-minimal-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform Ansible Core 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform-tech-preview/ee-minimal-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_core:2"
]
},
{
"vendor": "Red Hat",
"product": "Self-service automation portal 2",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-automation-platform/bootc-automation-portal-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_portal:2"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 0.8,
"impactScore": 5.9
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-59"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/security/cve/CVE-2026-123037",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567189",
"source": "[email protected]"
}
]
}