ansible-jailexec
Ansible Connection Plugin for FreeBSD Jails via jexec
View on Github
Activity
- Latest release
- 1mo ago
- Total releases
- 5
- Cadence
- ~25 days
- Last 12 months
- 5
Reach
- Stars
- 23
Details
- License
- BSD-3-Clause
- First release
- Apr 19, 2026
| Version | Released | |
|---|---|---|
2.0.2
patch
| ||
2.0.1
patch
| ||
2.0.0
major
| ||
1.3.0
minor
1 CVE
CVE-2026-55074
PYSEC-2026-3658
GHSA-cxgv-hp74-jj7r
Aug 19, 2026
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
Critical
Network
Low
Low
None
Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions: the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. Patches: Fixed in 2.0.0. File transfers now run inside the jail via jexec (mkdir -p && cat > for put_file; cat < for fetch_file), so every path resolves within the jail's chroot. An in-jail symlink can at most redirect within the same jail and can no longer reach the host. Workarounds: None in affected versions; upgrade to 2.0.0. Affected versions
1.2.0
1.3.0
Fixed in
2.0.0
References
Updated Aug 19, 2026 · Source: OSV.dev | ||
1.2.0
initial
1 CVE
CVE-2026-55074
PYSEC-2026-3658
GHSA-cxgv-hp74-jj7r
Aug 19, 2026
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
Critical
Network
Low
Low
None
Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions: the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. Patches: Fixed in 2.0.0. File transfers now run inside the jail via jexec (mkdir -p && cat > for put_file; cat < for fetch_file), so every path resolves within the jail's chroot. An in-jail symlink can at most redirect within the same jail and can no longer reach the host. Workarounds: None in affected versions; upgrade to 2.0.0. Affected versions
1.2.0
1.3.0
Fixed in
2.0.0
References
Updated Aug 19, 2026 · Source: OSV.dev |