CVE-2026-103754 Red Hat CVE debrief

Who should care

Defenders and administrators of ansible-runner installations should assess exposure and prioritize patching. This includes reviewing and restricting access to ansible-runner, monitoring logs for suspicious activity, and implementing compensating controls. The vulnerability can be leveraged toward code execution, making it critical for defenders to take action. Operators, platform administrators, and security teams should review the CVE record and source

Why it matters

The CVE-2026-103754 vulnerability in ansible-runner requires defenders to verify and patch installations to prevent potential file system exploitation.

• Potential for unauthorized file writes
• Possible elevation of privileges
• Risk of data tampering or corruption
• Need for verification and patching

Technical summary

The unstream_dir() function in ansible-runner is vulnerable to path traversal and symlink escape, allowing for file writes outside the target directory. This flaw can be exploited by a crafted archive processed by a worker, potentially leading to code execution. The vulnerability requires defenders to verify and patch installations to prevent potential file system exploitation. The CVE record and source item provide details on the flaw, including its potential impact on file system operations. Defenders should prioritize verifying and patching ansible-runner installations.

Defensive priority

Defenders should prioritize verifying and patching ansible-runner installations, especially in environments where automation and orchestration are critical.

Recommended defensive actions

• Verify and apply patches for ansible-runner
• Review and restrict access to ansible-runner
• Monitor ansible-runner logs for suspicious activity
• Perform vulnerability scanning
• Implement compensating controls
• Inventory ansible-runner assets
• Track changes to ansible-runner configurations

Evidence notes

The CVE record and source item provide details on the flaw in ansible-runner, including its potential impact on file system operations. The unstream_dir() function receives and extracts a streamed zip archive on the worker side of the ansible-runner transmit/worker protocol. A crafted archive can create files, create symbolic links, or change permissions outside the intended target directory. Defenders should verify and patch installations, especially in environments where automation and orchestration are critical.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.