A flaw in the Ansible Core user module allows an unprivileged user to replace their ~/.ssh directory with a symlink to a root‑writable location. When the generate_ssh_key action is enabled, the module writes the newly created SSH key pair through that symlink and then changes the ownership of the files to the user. Because the symlink points to a world‑writable system directory, the key files can end up in directories processed by root‑owned automation services such as cron or dynamic MOTD scripts. Executing code from these files grants the attacker root privileges on the managed node. This is a symlink or relative path traversal vulnerability (CWE-59).

CVE-2026-123037 impacts systems running Ansible Core on nodes where the user module generate_ssh_key is enabled. The flaw affects any user running unprivileged Ansible tasks that invoke this module on a managed host. No specific hardware or operating system versions are listed, so all current Ansible Core installations with the module are potentially vulnerable.

The CVSS score of 6.7 indicates a moderate severity, reflecting that the vulnerability requires local execution of the Ansible module but does not involve network interaction. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. Nevertheless, the exploitation method is straightforward: an attacker who can run arbitrary Ansible code on the node can create the symlink and trigger the local key generation, leading to privilege escalation at the node level.