Cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aredhatansible_tower3.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 09 Oct 2026 00:27:59 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgArbitrary File Write in ansible-core via Malicious Collection Installationhttps://feed.craftedsignal.io/briefs/2026-10-ansible-core-traversal/Fri, 09 Oct 2026 00:27:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-ansible-core-traversal/A path traversal vulnerability in ansible-core allows attackers to execute arbitrary code on a control node by distributing a crafted collection tarball that bypasses symlink validation.CVE-2026-89091 describes a critical path traversal vulnerability within the ansible-core archive extraction process. During the execution of 'ansible-galaxy collection install', the system performs lexical path normalization via 'os.path.abspath' but fails to resolve symbolic links or conduct containment checks before processing directory members within a tarball. An attacker can construct a malicious collection containing chained symlink directory entries that point outside the intended installation path. When an unsuspecting user installs the collection, the extraction process follows these symlinks and overwrites arbitrary files on the local filesystem. Because 'ansible-galaxy' typically runs with the permissions of the invoking user, this flaw enables arbitrary file write, which can be leveraged to achieve code execution on the control node. This vulnerability represents a regression or bypass of the mitigations previously introduced for CVE-2020-10691. Organizations should prioritize updating ansible-core to the vendor-patched release.

Impact

Successful exploitation allows a malicious actor to overwrite critical files on the system running 'ansible-galaxy'. If the victim is a privileged user or service account, the attacker can achieve persistent code execution on the control node, potentially leading to full compromise of the automation environment and subsequent lateral movement across the infrastructure managed by Ansible.

Recommendation

  • Patch ansible-core to the latest version provided by Red Hat that addresses CVE-2026-89091.
  • Audit build pipelines and CI/CD runners to ensure only collections from trusted, verified sources are installed.
  • Restrict the permissions of accounts authorized to run 'ansible-galaxy collection install' to minimize the impact of potential file overwrite attacks.
]]>highadvisoryvulnerabilitycode-executionpath-traversal