This vulnerability involves improper link resolution before file access in the ansible.posix authorized_key module on Red Hat Enterprise Linux 10. The keyfile() function incorrectly uses os.chown() instead of os.lchown() and does not use the O_NOFOLLOW flag when opening files, which allows symbolic links to be followed. An unprivileged local user can create symbolic links in their ~/.ssh directory that redirect file ownership changes to arbitrary system files or directories when the authorized_key task is executed with root privileges, resulting in local privilege escalation. The CVSS v3.1 score is 7.3, indicating high severity. No official patch or remediation level is currently stated in the vendor advisory.

Successful exploitation allows an unprivileged local user to escalate privileges to root by manipulating symbolic links in their ~/.ssh directory. This can lead to unauthorized ownership changes of arbitrary system files or directories, potentially compromising system integrity, confidentiality, and availability.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11837 for current remediation guidance. Until a fix is available, avoid running the ansible.posix authorized_key task as root on untrusted user directories or environments. Monitor Red Hat communications for updates on patches or workarounds.