# CVE-2026-123037: Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902) Status: published. Published: 2026-11-06. Updated: 2026-11-06. A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902. ## Remediation - workaround: Do not use generate_ssh_key: yes against accounts whose home directory is controlled by an untrusted user; pre-create ~/.ssh as a real directory owned appropriately before running the module, or generate the key as the target account itself (dropping to its uid/gid) rather than as root. (source: CNA: redhat) ## Affected products and versions - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-24/hub-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-24/lightspeed-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/controller-rhel8-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/de-minimal-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/de-supported-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/eda-controller-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/eda-controller-rhel8-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/ee-minimal-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/ee-minimal-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/ee-supported-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/ee-supported-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/gateway-rhel8-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/hub-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/hub-rhel8-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/lightspeed-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/lightspeed-rhel8-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/platform-resource-rhel8-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-25/platform-resource-runner-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/controller-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/de-minimal-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/de-supported-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/eda-controller-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/eda-controller-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/ee-minimal-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/ee-supported-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/gateway-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/hub-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/hub-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/lightspeed-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/lightspeed-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/platform-resource-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-26/platform-resource-runner-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/aap-cloud-billing-operator-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/controller-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/de-minimal-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/de-supported-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/eda-controller-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/eda-controller-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/ee-minimal-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/ee-supported-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/gateway-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/hub-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/hub-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/lightspeed-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/lightspeed-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/metrics-service-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/platform-resource-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-27/platform-resource-runner-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-tech-preview/ansible-devspaces-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-automation-platform-tech-preview/metrics-service-rhel9-operator): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform 2 (ansible-core): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform Ansible Core 2 (ansible-automation-platform/ee-minimal-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform Ansible Core 2 (ansible-automation-platform/ee-minimal-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform Ansible Core 2 (ansible-automation-platform-tech-preview/ee-minimal-rhel8): Version range not reported. Source: CNA: redhat - Red Hat / Red Hat Ansible Automation Platform Ansible Core 2 (ansible-automation-platform-tech-preview/ee-minimal-rhel9): Version range not reported. Source: CNA: redhat - Red Hat / Self-service automation portal 2 (ansible-automation-platform/bootc-automation-portal-rhel9): Version range not reported. Source: CNA: redhat ## Severity and prioritization - CVSS 3.1: 6.7 (medium); CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H; source: CNA: redhat - CISA KEV: No listing in collected sources - EPSS: Not available - SSVC: Not available - Weaknesses: CWE-59 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://access.redhat.com/security/cve/CVE-2026-123037 (CNA: redhat; vdb-entry, x_refsource_REDHAT) - https://bugzilla.redhat.com/show_bug.cgi?id=2567189 (CNA: redhat; issue-tracking, x_refsource_REDHAT) ## Provenance - CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-123037; retrieved 2026-11-06; source updated 2026-11-06 Revision: 2f45effa3bc9a75bcf4f98ade377ead95f1349c17c18cdcbaae9ef20fa478ea9 Canonical: https://y2.dev/cve/CVE-2026-123037 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.