CVE-2026-55074
Received Received - Intake

Symlink Following Arbitrary Root Write in Ansible FreeBSD Jail Connection Plugin

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions for this vulnerability are that the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. This issue has been fixed in version 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-55074
EUVD
EUVD-2026-83940

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
ansible ansible to 2.0.0 (exc)
ansible ansible 2.0.0
chofstede ansible_jailexec to 2.0.0 (exc)
chofstede ansible_jailexec 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-55074 is a jail-escape vulnerability in Ansible FreeBSD Jail Connection Plugin versions prior to 2.0.0. The issue occurs in the put_file function of the jailexec connection plugin, which resolves file transfer destinations to host-side paths outside the jail. When executing privileged commands like mkdir -p and mv as root on the host, these commands follow symbolic links. An attacker controlling content inside the jail can create a symlink that redirects the host-side mv operation to write to arbitrary root-owned files on the host, breaking out of the jail.

Detection Guidance

To detect this vulnerability, check the installed version of ansible_jailexec. Run: pip show ansible-jailexec or grep ansible_jailexec requirements.txt. If the version is below 2.0.0, the system is vulnerable. Additionally, review Ansible playbooks for tasks using put_file against FreeBSD jails.

Impact Analysis

This vulnerability allows an attacker with control over jail content to perform arbitrary root-owned writes on the host system outside the jail. This can lead to full host compromise, such as modifying system files like cron jobs, rc.d scripts, or SSH authorized keys. The impact requires the operator to run a file transfer task (e.g., copy, template, or fetch) against the jail, with the attacker placing a symlink inside the jail before the transfer.

Compliance Impact

This vulnerability could lead to unauthorized root-level access on the host system, potentially compromising sensitive data environments. For GDPR, it risks unauthorized access to personal data. For HIPAA, it may expose protected health information. Compliance violations could occur if such breaches lead to data exposure or loss of isolation controls.

Mitigation Strategies

Upgrade ansible_jailexec to version 2.0.0 or later immediately. Remove unnecessary doas/sudo rules and ensure only jexec access is required. Review inventory settings and update ansible_jail_user if needed. Verify file transfers now execute inside the jail.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55074. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart