DEBIAN-CVE-2026-89091

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-89091
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89091.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-89091
Upstream
  • CVE-2026-89091
Published
2026-10-08T22:17:35Z
Modified
2026-10-10T09:47:44Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.

References

Affected packages

Debian:12 / ansible-core

Package

Name
ansible-core
Purl
pkg:deb/debian/ansible-core?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.14.3-1
2.14.6-1
2.14.7-1
2.14.8-1
2.14.9-1
2.14.9-2
2.14.10-1
2.14.11-1
2.14.11-2
2.14.13-1
2.14.16-0+deb12u1
2.14.18-0+deb12u1
2.14.18-0+deb12u2
2.16.5-1
2.16.6-1
2.17.0-1
2.17.1-1
2.17.2-1
2.17.3-1
2.17.5-1
2.17.5-2
2.17.5-3
2.17.5-4
2.17.5-5
2.18.0-1
2.18.0-2
2.18.1-1
2.18.1-2
2.18.1-3
2.18.1-4
2.18.3-1
2.19~pre20250506~462affa7c4-1
2.19~pre20250510~5347d4d4fc-1
2.19.0~beta1-1
2.19.0~beta1-2
2.19.0~beta2-1
2.19.0~beta4-1
2.19.0~beta5-1
2.19.0~beta6-1
2.19.0~rc2-1
2.19.0-1
2.19.1-1
2.19.2-1
2.19.3-1
2.19.3-2
2.19.4-1
2.20.1-1
2.20.3-1
2.21.0-1
2.21.1~rc1-1
2.21.1~rc1-2
2.21.2-1
2.22.0~beta1-1
2.22.0~beta2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89091.json"

Debian:13 / ansible-core

Package

Name
ansible-core
Purl
pkg:deb/debian/ansible-core?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.19.0~beta6-1
2.19.0~rc2-1
2.19.0-1
2.19.1-0+deb13u1
2.19.1-1
2.19.2-1
2.19.3-1
2.19.3-2
2.19.4-0+deb13u1
2.19.4-1
2.19.11-0+deb13u1
2.20.1-1
2.20.3-1
2.21.0-1
2.21.1~rc1-1
2.21.1~rc1-2
2.21.2-1
2.22.0~beta1-1
2.22.0~beta2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89091.json"

Debian:14 / ansible-core

Package

Name
ansible-core
Purl
pkg:deb/debian/ansible-core?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.19.0~beta6-1
2.19.0~rc2-1
2.19.0-1
2.19.1-1
2.19.2-1
2.19.3-1
2.19.3-2
2.19.4-1
2.20.1-1
2.20.3-1
2.21.0-1
2.21.1~rc1-1
2.21.1~rc1-2
2.21.2-1
2.22.0~beta1-1
2.22.0~beta2-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-89091.json"