A local privilege escalation vulnerability was found in the ansible.posix authorizedkey module.
CVE-2026-11837
A local privilege escalation vulnerability was found in the ansible.posix authorizedkey module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without ONOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect file ownership changes to arbitrary system paths when an operator runs the authorizedkey task as root, leading to local privilege escalation.
Proof-of-concept code is published
Public PoC
- Public PoCM8seven/cve-2026-11837-ansible-posix-authorized-key1 stars
Signals come from Exploit-DB, Metasploit, Nuclei and published proof-of-concept repositories. Their absence means nothing was found, not that nothing exists.
Assessment
- CVSS
- 7.3 (v3.1)
- Severity
- High
- EPSS
- 0.16% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Public PoC
- Published
- 10 June 2026
- Last updated
- 2 November 2026
- Affected
- Red Hat · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support · Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
- Assigner
- redhat
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
At the source
References
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-11837