CVE-2026-103754 in Ansible Automation Platform
Summary
by MITRE • 10/01/2026
A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol, re-creates symbolic links from archive content without validating the link target and applies chmod() and utime() to an unsanitized filesystem path derived from the archive member name. A crafted archive processed by a worker that consumes attacker-influenced input can create files, create symbolic links, or change permissions outside the intended target directory, which can be leveraged toward code execution.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in ansible-runner represents a critical path traversal and arbitrary file write flaw within the transmit/worker protocol architecture. This specific issue resides in the unstream_dir() function, which is responsible for receiving and extracting streamed zip archives on the worker side of the communication channel between an Ansible controller node and its remote workers. The core technical deficiency lies in the lack of rigorous validation when processing archive metadata. Specifically, the function reconstructs symbolic links directly from the content of the archive without verifying that the link target resides within a safe or intended directory boundary. Furthermore, the system applies file permission changes via chmod() and timestamp updates via utime() to filesystem paths derived directly from the un-sanitized member names found in the zip archive entries. This combination of unchecked path resolution and direct application of operating system commands creates a severe security gap that allows an attacker with control over the input data to manipulate the underlying host file system beyond the scope of the intended execution context.
From an operational perspective, this vulnerability enables attackers to achieve arbitrary code execution by leveraging the ability to write files or create symbolic links outside the designated working directory. By crafting a malicious zip archive containing entries with carefully constructed paths and link targets, an attacker can overwrite critical system binaries, configuration files, or scripts that are subsequently executed by privileged processes. For instance, if the ansible-runner worker operates with elevated privileges, writing a shell script to /usr/local/bin/ or modifying a cron job entry could result in persistent remote code execution on the host machine. The impact is particularly severe because ansible-runner often runs as part of automated deployment pipelines where high-privilege accounts are common, thereby amplifying the potential for full system compromise. This flaw effectively bypasses standard sandboxing expectations associated with containerized or isolated worker environments, allowing lateral movement and privilege escalation within the infrastructure managed by Ansible.
In terms of industry classification standards, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The failure to validate that symbolic link targets are contained within an expected directory structure is a classic manifestation of this weakness. Additionally, the aspect involving the creation of arbitrary files and modification of permissions relates to CWE-732: Incorrect Permission Assignment for Critical Resource. From a tactical standpoint, this exploit scenario maps directly to MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as it facilitates the execution of attacker-controlled code through file system manipulation. It also touches upon T1486 Data Encrypted for Impact if the write operation is used to deploy ransomware or destructive payloads via the compromised worker node.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary solution involves upgrading ansible-runner to a version that includes patches addressing this specific validation logic, ensuring that all archive member paths are canonicalized and verified against an allowed base directory before any file system operations are performed. Developers should implement strict allow-listing for path components and reject any entry where the resolved absolute path does not start with the expected extraction root. Furthermore, symbolic link creation during extraction should be disabled or strictly validated to ensure targets do not escape the sandboxed environment. Organizations relying on ansible-runner in untrusted network segments or multi-tenant environments must also enforce strict input validation at the controller level before transmitting playbooks and associated artifacts to workers. Regular auditing of worker permissions and limiting the privileges under which ansible-runner executes can further reduce the blast radius should a similar vulnerability be discovered in the future, adhering to the principle of least privilege essential for secure automation infrastructure.