{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.2.10-1.el10_2","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 10.0 Extended Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.2.3-6.el10_0.2","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.8-2.el8_6.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.8-2.el8_6.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 8.8 Telecommunications Update Service","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.8-5.el8_8.1","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:0.1.8-5.el8_8.1","versionType":"rpm"}]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel-system-roles","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel-system-roles","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel-system-roles","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-collection-ansible-posix","product":"Red Hat OpenStack Platform 17.1","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-collection-ansible-posix","product":"Red Hat OpenStack Platform 18.0","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 10","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel-system-roles","product":"Red Hat Enterprise Linux 10","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 8","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel-system-roles","product":"Red Hat Enterprise Linux 8","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 9","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhel-system-roles","product":"Red Hat Enterprise Linux 9","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-collection-ansible-posix","product":"Red Hat OpenStack Platform 17.1","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"ansible-collection-ansible-posix","product":"Red Hat OpenStack Platform 18.0","source":"ADP: redhat-SADP","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-11837","cwes":["CWE-59"],"description":"A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorized_key task as root, leading to local privilege escalation.","epss":{"date":"2026-11-04","percentile":0.05561,"score":0.00163},"exploits":[],"kev":null,"metrics":[{"score":7.3,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.3,"severity":"high","source":"ADP: redhat-SADP","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.3,"severity":"high","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},{"score":7.3,"severity":"high","source":"NVD: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793830673257,"publishedAt":1781067785734,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:42946"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:79112"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:80508"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:82339"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-11837"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487424"},{"source":"ADP: redhat-SADP","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-11837"},{"source":"ADP: redhat-SADP","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487424"},{"source":"ADP: redhat-SADP","tags":["x_sadp-csaf-vex"],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11837.json"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:42946"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:79112"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:80508"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2026:82339"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-11837"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487424"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-11837"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487424"},{"source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","tags":[],"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11837.json"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"The following practices would help for avoiding exposure and mitigate this flaw:\n\n1) Do not run the ansible.posix authorized_key module with elevated privileges against untrusted user accounts. \n2) Validate that target user home directories do not contain unexpected symbolic links before running playbooks."},{"kind":"workaround","source":"ADP: redhat-SADP","text":"The following practices would help for avoiding exposure and mitigate this flaw:\n\n1) Do not run the ansible.posix authorized_key module with elevated privileges against untrusted user accounts. \n2) Validate that target user home directories do not contain unexpected symbolic links before running playbooks."}],"revision":"46a34772c52aadd7d6615be347f31a1f18df33d067726e5e1903632433e72046","sources":[{"modifiedAt":1793829076244,"name":"CNA: redhat","retrievedAt":1793830330824,"url":"https://www.cve.org/CVERecord?id=CVE-2026-11837"},{"modifiedAt":1793830673257,"name":"NVD","retrievedAt":1793838021578,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11837"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793830356060,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-11837"}],"ssvc":{"assessedAt":1781099855655,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Ansible-collection-ansible-posix: ansible.posix authorized_key: local privilege escalation via symlink-following chown","updatedAt":1793838021578}