Ansible FreeBSD Jail Connection Plugin Vulnerability: CVE-2026-55074

Executive Summary

A critical vulnerability (CVE-2026-55074) exists in the Ansible FreeBSD Jail Connection Plugin up to version 1.3.0, allowing a jail escape. An attacker with control over content inside a managed jail can create a symlink to achieve an arbitrary root-owned write on the host, potentially leading to a full host compromise. The vulnerability has a CVSS score of 7.3 and is classified as CWE-59: Improper Link Resolution Before File Access ('Link Following').

Technical Analysis

The vulnerability is caused by the jailexec connection plugin's `put_file` function resolving the destination path on the jail host and running `mkdir -p` and `mv` as root. These commands follow symbolic links, allowing an attacker to create a symlink inside the jail that, when followed by the host-side `mv` command, enables writing arbitrary files on the host as root. This is a case of improper link resolution before file access.

How It Gets Exploited

An attacker exploiting this vulnerability would need to: - Control content inside a managed jail. - Create a symlink in a directory that an Ansible task later writes to, before the task runs. - When the operator runs a copy/template/fetch-style task (using `put_file`) against the jail, the symlink is followed by the host-side, root-privileged `mv`, allowing an arbitrary root-owned write on the host.

Impact Assessment

The vulnerability affects Ansible FreeBSD Jail Connection Plugin versions up to 1.3.0. Successful exploitation allows for a full jail escape and can lead to arbitrary root-owned writes on the host, readily escalating to host compromise. The CVSS score of 7.3 indicates a high severity level.

Recommended Actions

- **Update the Ansible FreeBSD Jail Connection Plugin to version 2.0.0 or later**. This version fixes the vulnerability by running file transfers inside the jail via `jexec`, ensuring that paths resolve within the jail's chroot and preventing the symlink following issue. - **Avoid running copy/template/fetch-style tasks against jails controlled by untrusted parties** until the plugin is updated. - **Monitor for suspicious activity** within managed jails that could indicate attempted exploitation.

Sources

- GitHub Security Advisories: https://github.com/advisories/GHSA-cxgv-hp74-jj7r - CVE-2026-55074