CVE-2026-11837

Name of the Vulnerable Software and Affected Versions ansible.posix (affected versions not specified)

Description A local privilege escalation issue exists in the authorized key module. The keyfile() function utilizes os.chown() instead of os.lchown() and opens files without the O NOFOLLOW flag when managing SSH authorized keys. This allows an unprivileged local user to create symbolic links in their ~/.ssh directory, redirecting file ownership changes to arbitrary system paths when an operator executes the authorized key task as root.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.