{"id":"CVE-2026-89091","published":"2026-10-08T22:17:35.777","lastModified":"2026-10-09T16:37:45.710","description":"A flaw was found in ansible-core. When installing a collection with\n`ansible-galaxy collection install`, the archive extractor validates member\npaths using lexical path normalisation (os.path.abspath) instead of resolving\nsymbolic links (os.path.realpath), and it performs no containment check on\nsymlink-typed directory members before creating them. A crafted collection\ntarball can chain symlink directory entries so that a subsequent file member is\nwritten outside the intended destination directory. This allows an attacker who\ncan get a victim to install a malicious collection to overwrite arbitrary files\nwith the privileges of the user running ansible-galaxy, leading to code\nexecution on the control node. This is a bypass of the fix for CVE-2020-10691.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-89091","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2531646","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows an attacker to overwrite arbitrary files by chaining symbolic links in a crafted collection tarball, leading to code execution.","exploitability":"Exploitation requires the attacker to get a victim to install a malicious collection, which is moderately hard to achieve.","blast_radius":"If exploited, the attacker can execute code with the privileges of the user running ansible-galaxy, potentially leading to full system compromise.","remediation":"Upgrade to ansible-core 2.11.8 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","file-overwrite","ansible","collection"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:44:36.231Z"}}