CVE-2026-89091: Improper Link Resolution Before File Access ('Link Following') in Red Hat Migration Toolkit for Applications 8

The vulnerability arises from ansible-core's archive extractor validating member paths using os.path.abspath rather than os.path.realpath, failing to resolve symbolic links properly. Additionally, it does not check containment for symlink-typed directory members before creation. An attacker can craft a malicious collection tarball that chains symlink directory entries, causing subsequent file members to be written outside the target directory. This leads to arbitrary file overwrite with the privileges of the ansible-galaxy user, potentially resulting in code execution on the control node. This issue bypasses the prior fix for CVE-2020-10691.

An attacker who convinces a victim to install a malicious collection can overwrite arbitrary files on the control node with the privileges of the user running ansible-galaxy. This can lead to code execution on the control node, compromising system integrity and confidentiality. The vulnerability has a CVSS 3.1 score of 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

The vendor advisory from Red Hat should be consulted for the current patch or remediation status. Since no explicit patch or fix information is provided in the input, patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-89091 for current remediation guidance. Until a fix is applied, avoid installing collections from untrusted sources to mitigate risk.