THREAT OPS › Threat News › [NVD] CVE-2026-11837 (HIGH 7.3) — A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage s
[NVD] CVE-2026-11837 (HIGH 7.3) — A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage s
CVE-2026-11837 CVSS: 7.3 HIGH Published: 2026-06-10T05:16:38.510
A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.chown() instead of os.lchown() and opens files without O_NOFOLLOW when managing SSH authorized keys. An unprivileged local user can pre-stage symbolic links in their ~/.ssh directory to redirect fi
MITRE ATT&CK techniques
- SSH Authorized KeysT1098.004
Indicators of compromise
- CVE-2026-11837cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-11837