HIGH GitHub
CVE-2026-55074
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host (<jail filesystem root> + <destination>) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv.
A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink
Affected Products
- pip/ansible-jailexec < 2.0.0
References
- https://github.com/advisories/GHSA-cxgv-hp74-jj7r
- https://github.com/chofstede/ansible_jailexec/security/advisories/GHSA-cxgv-hp74-jj7r
- https://github.com/chofstede/ansible_jailexec/commit/6e80eecb2db7aebd1258fded6ae5c3aba1dd4
- https://github.com/advisories/GHSA-cxgv-hp74-jj7r
This high severity vulnerability was published on 2026-08-12 via GitHub. Affected: pip/ansible-jailexec < 2.0.0.
vulnfeed aggregates 10530 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.