high

CVE-2026-55074

PyPI · ansible-jailexec

Summary

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Severity
high
EPSS
0.4% (p38)
CWE
CWE-59
Also known as
GHSA-cxgv-hp74-jj7r
Published
2026-08-12
Updated
2026-08-13

Advisory details

Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv.

A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys).

Preconditions: the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs.

Patches: Fixed in 2.0.0. File transfers now run inside the jail via jexec (mkdir -p

&& cat > for put_file; cat < for fetch_file), so every path resolves within the jail's chroot. An in-jail symlink can at most redirect within the same jail and can no longer reach the host.

Workarounds: None in affected versions; upgrade to 2.0.0.

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.