Skip to content
Fencer Intel
medium 6.7

CVE-2026-123037 json

Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)

published 3d ago modified 3d ago also EUVD-2026-117890

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 1%
public exploits
0
none known

Summary

A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.

Is CVE-2026-123037 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-123037 updated cvss 6.7

ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of CVE-2024-9902)

  • Red Hat Migration Toolkit for Applications 8 mta/mta-rhel9-operator Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-rhel9-operator, migration-toolkit-virtualization/mtv-rhel9-operator Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operator Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/volsync-rhel9, rhacm2/volsync-operator-bundle Red Hat Ansible Automation Platform 2 ansible-core, ansible-automation-platform-24/hub-rhel8, ansible-automation-platform-25/hub-rhel8, ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-27/hub-rhel9, ansible-automation-platform-24/lightspeed-rhel8, +44 more Red Hat Ansible Automation Platform Ansible Core 2 ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9, ansible-automation-platform-tech-preview/ee-minimal-rhel8, ansible-automation-platform-tech-preview/ee-minimal-rhel9
    +9 more products
    Red Hat Discovery 2 discovery/discovery-server-rhel9 Red Hat Enterprise Linux 8 ansible-core, ansible-test Red Hat Enterprise Linux 9 ansible-core, ansible-test Red Hat Enterprise Linux 10 ansible-core Red Hat OpenShift Container Platform 4 openshift4/ose-ansible-rhel9-operator Red Hat OpenShift Container Platform 5 openshift5/ose-ansible-rhel9-operator Red Hat Satellite 6 ansible-core Red Hat Self-service automation portal 2 ansible-automation-platform/bootc-automation-portal-rhel9 Red Hat Service Telemetry Framework 1.5 stf/smart-gateway-rhel9-operator, stf/service-telemetry-rhel9-operator
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Ansible Automation Platform 2 ansible-automation-platform-25/eda-controller-rhel8-operator
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3d ago

Exploit prediction

0.11% chance of exploitation in the next 30 days, higher than 1% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Migration Toolkit for Virtualization
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Ansible Automation Platform Ansible Core 2
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift Container Platform 4
  • Red Hat Red Hat OpenShift Container Platform 5
  • Red Hat Red Hat Satellite 6
  • Red Hat Self-service automation portal 2
  • Red Hat Service Telemetry Framework 1.5

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.