CVE-2026-89091: Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

Vulnerability summary

CVE-2026-89091 is a high (CVSS 8.8) vulnerability in ansible-core. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 41.4% of scored vulnerabilities.

Timeline

1. 08-10-2026
   PublishedVulnerability first disclosed.
2. 02-11-2026
   Last modifiedVulnerability information updated.

Description

A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.

• CWE-59Improper Link Resolution Before File AccessThe product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.