---
id: CVE-2026-123037
title: >-
  Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling
  local privilege escalation (incomplete fix of cve-2024-9902)
summary: >-
  A flaw was found in the ansible-core user module. When generate_ssh_key is
  enabled, User.ssh_key_gen() guards the key files against symlinks but checks
  the ~/.ssh directory only with os.path.exists(). An unprivileged user on a
  managed no…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-59
vendor: Red Hat
product: ansible-automation-platform-24/hub-rhel8
affected:
  - ansible-automation-platform-24/hub-rhel8 (all versions)
  - ansible-automation-platform-24/lightspeed-rhel8 (all versions)
  - ansible-automation-platform-25/controller-rhel8-operator (all versions)
  - ansible-automation-platform-25/de-minimal-rhel8 (all versions)
  - ansible-automation-platform-25/de-supported-rhel8 (all versions)
  - ansible-automation-platform-25/eda-controller-rhel8 (all versions)
  - ansible-automation-platform-25/eda-controller-rhel8-operator
  - ansible-automation-platform-25/ee-minimal-rhel8 (all versions)
  - ansible-automation-platform-25/ee-minimal-rhel9 (all versions)
  - ansible-automation-platform-25/ee-supported-rhel8 (all versions)
  - ansible-automation-platform-25/ee-supported-rhel9 (all versions)
  - ansible-automation-platform-25/gateway-rhel8-operator (all versions)
  - ansible-automation-platform-25/hub-rhel8 (all versions)
  - ansible-automation-platform-25/hub-rhel8-operator (all versions)
  - ansible-automation-platform-25/lightspeed-rhel8 (all versions)
  - ansible-automation-platform-25/lightspeed-rhel8-operator (all versions)
  - >-
    ansible-automation-platform-25/platform-resource-rhel8-operator (all
    versions)
  - ansible-automation-platform-25/platform-resource-runner-rhel8 (all versions)
  - ansible-automation-platform-26/controller-rhel9-operator (all versions)
  - ansible-automation-platform-26/de-minimal-rhel9 (all versions)
  - ansible-automation-platform-26/de-supported-rhel9 (all versions)
  - ansible-automation-platform-26/eda-controller-rhel9 (all versions)
  - ansible-automation-platform-26/eda-controller-rhel9-operator (all versions)
  - ansible-automation-platform-26/ee-minimal-rhel9 (all versions)
  - ansible-automation-platform-26/ee-supported-rhel9 (all versions)
  - ansible-automation-platform-26/gateway-rhel9-operator (all versions)
  - ansible-automation-platform-26/hub-rhel9 (all versions)
  - ansible-automation-platform-26/hub-rhel9-operator (all versions)
  - ansible-automation-platform-26/lightspeed-rhel9 (all versions)
  - ansible-automation-platform-26/lightspeed-rhel9-operator (all versions)
  - >-
    ansible-automation-platform-26/platform-resource-rhel9-operator (all
    versions)
  - ansible-automation-platform-26/platform-resource-runner-rhel9 (all versions)
  - >-
    ansible-automation-platform-27/aap-cloud-billing-operator-rhel9 (all
    versions)
  - ansible-automation-platform-27/controller-rhel9-operator (all versions)
  - ansible-automation-platform-27/de-minimal-rhel9 (all versions)
  - ansible-automation-platform-27/de-supported-rhel9 (all versions)
  - ansible-automation-platform-27/eda-controller-rhel9 (all versions)
  - ansible-automation-platform-27/eda-controller-rhel9-operator (all versions)
  - ansible-automation-platform-27/ee-minimal-rhel9 (all versions)
  - ansible-automation-platform-27/ee-supported-rhel9 (all versions)
  - ansible-automation-platform-27/gateway-rhel9-operator (all versions)
  - ansible-automation-platform-27/hub-rhel9 (all versions)
  - ansible-automation-platform-27/hub-rhel9-operator (all versions)
  - ansible-automation-platform-27/lightspeed-rhel9 (all versions)
  - ansible-automation-platform-27/lightspeed-rhel9-operator (all versions)
  - ansible-automation-platform-27/metrics-service-rhel9-operator (all versions)
  - >-
    ansible-automation-platform-27/platform-resource-rhel9-operator (all
    versions)
  - ansible-automation-platform-27/platform-resource-runner-rhel9 (all versions)
  - >-
    ansible-automation-platform-tech-preview/ansible-devspaces-rhel9 (all
    versions)
  - >-
    ansible-automation-platform-tech-preview/metrics-service-rhel9-operator (all
    versions)
published: '2026-11-06'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T05:38:54.180Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123037'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-123037'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2567189'
    label: RHBZ#2567189
tags:
  - cve.org
ingestedAt: '2026-11-06T06:46:27.286Z'
---

## Overview

A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.

## Affected

- `ansible-automation-platform-24/hub-rhel8 (all versions)`
- `ansible-automation-platform-24/lightspeed-rhel8 (all versions)`
- `ansible-automation-platform-25/controller-rhel8-operator (all versions)`
- `ansible-automation-platform-25/de-minimal-rhel8 (all versions)`
- `ansible-automation-platform-25/de-supported-rhel8 (all versions)`
- `ansible-automation-platform-25/eda-controller-rhel8 (all versions)`
- `ansible-automation-platform-25/eda-controller-rhel8-operator`
- `ansible-automation-platform-25/ee-minimal-rhel8 (all versions)`
- `ansible-automation-platform-25/ee-minimal-rhel9 (all versions)`
- `ansible-automation-platform-25/ee-supported-rhel8 (all versions)`
- `ansible-automation-platform-25/ee-supported-rhel9 (all versions)`
- `ansible-automation-platform-25/gateway-rhel8-operator (all versions)`
- `ansible-automation-platform-25/hub-rhel8 (all versions)`
- `ansible-automation-platform-25/hub-rhel8-operator (all versions)`
- `ansible-automation-platform-25/lightspeed-rhel8 (all versions)`
- `ansible-automation-platform-25/lightspeed-rhel8-operator (all versions)`
- `ansible-automation-platform-25/platform-resource-rhel8-operator (all versions)`
- `ansible-automation-platform-25/platform-resource-runner-rhel8 (all versions)`
- `ansible-automation-platform-26/controller-rhel9-operator (all versions)`
- `ansible-automation-platform-26/de-minimal-rhel9 (all versions)`
- `ansible-automation-platform-26/de-supported-rhel9 (all versions)`
- `ansible-automation-platform-26/eda-controller-rhel9 (all versions)`
- `ansible-automation-platform-26/eda-controller-rhel9-operator (all versions)`
- `ansible-automation-platform-26/ee-minimal-rhel9 (all versions)`
- `ansible-automation-platform-26/ee-supported-rhel9 (all versions)`
- `ansible-automation-platform-26/gateway-rhel9-operator (all versions)`
- `ansible-automation-platform-26/hub-rhel9 (all versions)`
- `ansible-automation-platform-26/hub-rhel9-operator (all versions)`
- `ansible-automation-platform-26/lightspeed-rhel9 (all versions)`
- `ansible-automation-platform-26/lightspeed-rhel9-operator (all versions)`
- `ansible-automation-platform-26/platform-resource-rhel9-operator (all versions)`
- `ansible-automation-platform-26/platform-resource-runner-rhel9 (all versions)`
- `ansible-automation-platform-27/aap-cloud-billing-operator-rhel9 (all versions)`
- `ansible-automation-platform-27/controller-rhel9-operator (all versions)`
- `ansible-automation-platform-27/de-minimal-rhel9 (all versions)`
- `ansible-automation-platform-27/de-supported-rhel9 (all versions)`
- `ansible-automation-platform-27/eda-controller-rhel9 (all versions)`
- `ansible-automation-platform-27/eda-controller-rhel9-operator (all versions)`
- `ansible-automation-platform-27/ee-minimal-rhel9 (all versions)`
- `ansible-automation-platform-27/ee-supported-rhel9 (all versions)`
- `ansible-automation-platform-27/gateway-rhel9-operator (all versions)`
- `ansible-automation-platform-27/hub-rhel9 (all versions)`
- `ansible-automation-platform-27/hub-rhel9-operator (all versions)`
- `ansible-automation-platform-27/lightspeed-rhel9 (all versions)`
- `ansible-automation-platform-27/lightspeed-rhel9-operator (all versions)`
- `ansible-automation-platform-27/metrics-service-rhel9-operator (all versions)`
- `ansible-automation-platform-27/platform-resource-rhel9-operator (all versions)`
- `ansible-automation-platform-27/platform-resource-runner-rhel9 (all versions)`
- `ansible-automation-platform-tech-preview/ansible-devspaces-rhel9 (all versions)`
- `ansible-automation-platform-tech-preview/metrics-service-rhel9-operator (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Do not use generate_ssh_key: yes against accounts whose home directory is controlled by an untrusted user; pre-create ~/.ssh as a real directory owned appropriately before running the module, or generate the key as the target account itself (dropping to its uid/gid) rather than as root.