{"id":"CVE-2026-89091","title":"A flaw was found in ansible-core","summary":"A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links …","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-59"],"published":"2026-10-08","updated":"2026-10-09","sourceUpdated":"2026-10-09T16:37:45.710","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89091","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-89091","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531646","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89091.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89091"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89091"}],"tags":["nvd","csaf","vex","red-hat","cve.org"],"ingestedAt":"2026-10-08T23:16:47.400Z","vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2","affected":["advanced_cluster_management_for_kubernetes 2","ansible_automation_platform 2","ansible_automation_platform_ansible_core 2","discovery 2","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","openshift_container_platform 4","openstack_platform 17.1","satellite 6","update_infrastructure 5","self_service_automation_portal 2"],"epss":0.0048,"epssPercentile":0.4121,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-09T15:00:00.715697Z"},"slug":"CVE-2026-89091","body":"## Overview\n\nA flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links (os.path.realpath), and it performs no containment check on\nsymlink-typed directory members before creating them. A crafted collection\ntarball can chain symlink directory entries so that a subsequent file member is\nwritten outside the intended destination directory. This allows an attacker who\ncan get a victim to install a malicious collection to overwrite arbitrary files\nwith the privileges of the user running ansible-galaxy, leading to code\nexecution on the control node. This is a bypass of the fix for CVE-2020-10691.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat Discovery 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, … · no fix planned: Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Discovery 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, … · updated 2026-10-09 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89091.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}