A vulnerability in the ansible.posix authorized_key module allows an unprivileged local user to create symbolic links in their ~/.ssh directory. When an operator runs the authorized_key task as root, the module’s keyfile() function performs an os.chown() on the targeted file without preventing symlink resolution, which can redirect the ownership change to an arbitrary system path. This results in the attacker gaining ownership of files they should not have access to, effectively elevating privileges on the local system. The weakness is a classic symlink‑follow security flaw (CWE‑59).

Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenStack Platform 17.1, and Red Hat OpenStack Platform 18.0

The CVSS score of 7.3 indicates high severity. EPSS information is not available and the vulnerability is not listed in CISA's KEV catalog. The attack vector is local; the attacker must have a user account on the host and must be able to pre‑stage the symlink in their own ~/.ssh directory before an operator executes the authorized_key task with elevated privileges. Once the symlink exists, the privileged run will change ownership of the target file, thus enabling local privilege escalation. The risk remains significant until a fix is applied, as the path to exploitation is straightforward and requires no specialized expertise beyond normal local access.