{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhc-worker-playbook","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-126644","cwes":["CWE-59"],"description":"A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). When an unprivileged local user replaces their ~/.ssh directory with a symlink to a directory they do not own, and an operator subsequently runs the authorized_key task as root (a common provisioning pattern), the module resolves its path operations through the symlink: atomic_move() writes the temporary file in the symlink target and renames it to <target>/authorized_keys, creating or overwriting a file in the attacker-chosen directory, and os.chmod(sshdir, 0o700) follows the symlink and changes the target directory's permissions. The written file is chowned to the unprivileged user, so this is not a privilege escalation, but it allows an attacker to create or overwrite files (for example in /etc/apt/apt.conf.d/, which APT reads regardless of file ownership) to cause integrity and availability impacts.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":3.9,"severity":"low","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","version":"3.1"},{"score":3.9,"severity":"low","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","version":"3.1"}],"modifiedAt":1794482231920,"publishedAt":1794480616148,"references":[{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-126644"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571732"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2026-126644"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2571732"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"Do not run ansible.posix.authorized_key as root against home or .ssh directories that unprivileged users can modify. Verify that target directories are not attacker-controllable symlinks before running the task."}],"revision":"ecd05be0a14b264184a3d448c49c940ea50b10969c3e09cba8952d5e7e085486","sources":[{"modifiedAt":1794480616148,"name":"CNA: redhat","retrievedAt":1794481708981,"url":"https://www.cve.org/CVERecord?id=CVE-2026-126644"},{"modifiedAt":1794482231920,"name":"NVD","retrievedAt":1794485826541,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126644"}],"ssvc":null,"status":"published","title":"Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory","updatedAt":1794485826541}