PYSEC-2026-1121

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/ansible-core/PYSEC-2026-1121.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-1121
Aliases
Published
2026-07-07T14:34:44.048440Z
Modified
2026-07-07T17:46:19.564022868Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
ansible-core Incorrect Authorization vulnerability
Details

A flaw was found in Ansible. The ansible-core user module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the user module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.

References

Affected packages

PyPI / ansible-core

Package

Name
ansible-core
View open source insights on deps.dev
Purl
pkg:pypi/ansible-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14.18rc1
Introduced
2.15.0b1
Fixed
2.15.13rc1
Introduced
2.16.0b1
Fixed
2.16.13rc1
Introduced
2.17.0b1
Fixed
2.17.6rc1
Introduced
2.18.0b1
Fixed
2.18.0rc2

Affected versions

0.*
0.0.1a1
2.*
2.11.0b1
2.11.0b2
2.11.0b3
2.11.0b4
2.11.0rc1
2.11.0rc2
2.11.0
2.11.1rc1
2.11.1
2.11.2rc1
2.11.2
2.11.3rc1
2.11.3
2.11.4rc1
2.11.4
2.11.5rc1
2.11.5
2.11.6rc1
2.11.6
2.11.7rc1
2.11.7
2.11.8rc1
2.11.8
2.11.9rc1
2.11.9
2.11.10rc1
2.11.10
2.11.11rc1
2.11.11
2.11.12rc1
2.11.12
2.12.0b1
2.12.0b2
2.12.0rc1
2.12.0
2.12.1rc1
2.12.1
2.12.2rc1
2.12.2
2.12.3rc1
2.12.3
2.12.4rc1
2.12.4
2.12.5rc1
2.12.5
2.12.6rc1
2.12.6
2.12.7rc1
2.12.7
2.12.8rc1
2.12.8
2.12.9rc1
2.12.9
2.12.10rc1
2.12.10
2.13.0b0
2.13.0b1
2.13.0rc1
2.13.0
2.13.1rc1
2.13.1
2.13.2rc1
2.13.2
2.13.3rc1
2.13.3
2.13.4rc1
2.13.4
2.13.5rc1
2.13.5
2.13.6rc1
2.13.6
2.13.7rc1
2.13.7
2.13.8rc1
2.13.8
2.13.9rc1
2.13.9
2.13.10rc1
2.13.10
2.13.11rc1
2.13.11
2.13.12rc1
2.13.12
2.13.13rc1
2.13.13
2.14.0b1
2.14.0b2
2.14.0b3
2.14.0rc1
2.14.0rc1.post0
2.14.0rc2
2.14.0
2.14.1rc1
2.14.1
2.14.2rc1
2.14.2
2.14.3rc1
2.14.3
2.14.4rc1
2.14.4
2.14.5rc1
2.14.5
2.14.6rc1
2.14.6
2.14.7rc1
2.14.7
2.14.8rc1
2.14.8
2.14.9rc1
2.14.9
2.14.10rc1
2.14.10
2.14.11rc1
2.14.11
2.14.12rc1
2.14.12
2.14.13
2.14.14rc1
2.14.14
2.14.15rc1
2.14.15
2.14.16rc1
2.14.16
2.14.17rc1
2.14.17
2.15.0b1
2.15.0b2
2.15.0b3
2.15.0rc1
2.15.0rc2
2.15.0
2.15.1rc1
2.15.1
2.15.2rc1
2.15.2
2.15.3rc1
2.15.3
2.15.4rc1
2.15.4
2.15.5rc1
2.15.5
2.15.6rc1
2.15.6
2.15.7rc1
2.15.7
2.15.8
2.15.9rc1
2.15.9
2.15.10rc1
2.15.10
2.15.11rc1
2.15.11
2.15.12rc1
2.15.12
2.16.0b1
2.16.0b2
2.16.0rc1
2.16.0
2.16.1rc1
2.16.1
2.16.2
2.16.3rc1
2.16.3
2.16.4rc1
2.16.4
2.16.5rc1
2.16.5
2.16.6
2.16.7rc1
2.16.7
2.16.8rc1
2.16.8
2.16.9rc1
2.16.9
2.16.10rc1
2.16.10
2.16.11rc1
2.16.11
2.16.12rc1
2.16.12
2.17.0b1
2.17.0rc1
2.17.0rc2
2.17.0
2.17.1rc1
2.17.1
2.17.2rc1
2.17.2rc2
2.17.2
2.17.3rc1
2.17.3
2.17.4rc1
2.17.4
2.17.5rc1
2.17.5
2.18.0b1
2.18.0rc1

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/ansible-core/PYSEC-2026-1121.yaml"