Red Hat Security Advisory: rhc-worker-playbook security update

The rhc-worker-playbook, a Python-based worker used to launch Ansible playbooks via Ansible Runner in Red Hat Enterprise Linux, contains a vulnerability (CVE-2026-11837) in the ansible-collection-ansible-posix's authorized_key module. This vulnerability allows local privilege escalation through symlink-following during a chown operation. Red Hat has issued a security update to address this issue in versions of Red Hat Enterprise Linux 8.8 and related update services. The advisory references the fix and provides updated package versions for affected architectures.

The vulnerability enables a local attacker to escalate privileges on affected systems by exploiting symlink-following behavior in the ansible.posix authorized_key module. This could lead to unauthorized access or control over system resources. The issue is rated as Important by Red Hat, indicating a significant security impact, though no CVSS score is provided.

Red Hat has released an official security update for rhc-worker-playbook that addresses this vulnerability. Users of Red Hat Enterprise Linux 8.8 and related update services should apply the provided update packages (rhc-worker-playbook-0.1.8-5.el8_8.1) to remediate the issue. Refer to Red Hat's official advisory and update instructions at https://access.redhat.com/articles/11258 for detailed guidance. No additional mitigation steps are indicated beyond applying the update.