Ansible Runner CVE-2026-103754

Requires a worker running the ansible-runner transmit/worker protocol that consumes attacker-influenced streamed archive input - i.e. the unstream_dir() code path must process a zip archive whose member names and symlink targets an attacker can control. Exploitation is limited by the need to supply crafted archive content into this specific protocol (PR:L - the attacker must have a foothold or role that lets them inject job/stream data, not arbitrary internet access), and by AC:H reflecting the crafting of valid archive members plus reliance on the worker extracting them. There is no required victim user interaction (UI:N). Affected: ansible-runner as shipped in Red Hat Ansible Automation Platform 2 (and AWX/upstream) on versions prior to the PR #1550 fix.

CVSS 3.1 base score is 5.9 (Red Hat vendor-assigned) with vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:L - a network-reachable but high-complexity, low-privilege integrity-focused flaw. No EPSS score, no CISA KEV listing, and no standalone public exploit were provided; however, the fixing PR (#1550) ships four adversarial unit tests that construct crafted transmit streams demonstrating symlink write-through, parent-traversal chmod/utime, absolute-member write, and unsafe symlink targets - this is functional proof-of-concept extraction code embedded in the patch, which materially lowers the barrier to weaponization even though it is not an actively-distributed exploit. The real-world risk is moderate and gated by a meaningful precondition: the worker side of the ansible-runner transmit/worker protocol must consume attacker-influenced archive content. This is not a mass-exploitable internet-facing bug; it is a priority primarily for environments where ansible-runner workers (e.g. execution nodes / automation mesh in AAP 2 or AWX) process streamed job data whose origin is not fully trusted. The AC:H and PR:L qualifiers correctly temper the otherwise-network vector. The 'RCE' tag reflects the description's 'can be leveraged toward code execution,' but the CVSS impact set models that as I:H/A:L with C:N rather than full CIA, so treat RCE as a plausible escalation outcome, not a confirmed single-step remote-code-execution primitive - verify exploitability-to-RCE path with vendor.

An attacker who can influence the content streamed to an ansible-runner worker crafts a malicious zip archive containing a symlink member pointing outside the target directory (e.g. '../outside') followed by a file member written through that symlink, plus '..'-prefixed members whose names drive chmod()/utime() on paths outside the extraction root. When the worker's unstream_dir() extracts the archive, it recreates the symlink and writes/alters files outside the intended directory, enabling file creation or permission changes on sensitive paths that can be chained toward code execution. The patch's own test suite (PR #1550) demonstrates each of these primitives, so working trigger code effectively exists even though no weaponized exploit or KEV entry is reported.