Ansible jailexec CVE-2026-55074

Exploitation requires ALL of: (1) an attacker who controls content inside a managed FreeBSD jail - the jail's root or any process able to create a symlink in a directory the transfer will touch; (2) the ability to place that symlink at or above the task's destination BEFORE the transfer runs (a timing/race precondition); and (3) the operator subsequently running a put_file-based task (copy/template/fetch) against that jail via ansible-jailexec < 2.0.0. Limiting factors: the attacker must already have a foothold inside the jail (not a purely external unauthenticated position), success depends on winning the placement-before-transfer window, and it is confined to hosts using this specific FreeBSD-jail plugin. Not exploitable on 2.0.0+, where transfers run inside the jail via jexec so all paths resolve within the chroot.

This is a genuine high-impact issue but with meaningful preconditions, so raw severity should be read against exploitability. The vendor's CVSS 4.0 vector (8.2, AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N) overstates remoteness and understates the outcome: the attacker does not act over the network against the plugin - they must already control content INSIDE a managed FreeBSD jail (be jail-root, or hold any process able to create a symlink in a directory a later Ansible task writes to), which is a privileged foothold, not PR:N. Conversely, the impact is understated: a symlink-followed, host-side, root-privileged mv yields an arbitrary root-owned write OUTSIDE the jail - a full jail escape that the advisory itself notes is readily escalated to complete host compromise (cron, rc.d, authorized_keys), i.e. a scope-changing C:H/I:H/A:H on the host, not integrity-only. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis; combined with the AC:H timing/precondition and the niche footprint, this is a real fix-it-when-you-upgrade priority for the small population running the plugin rather than a mass-exploitation threat. Patch availability is CONFIRMED (v2.0.0). Note the metadata conflict: CVSS says AV:N while the attack fundamentally requires an attacker-controlled position inside the jail - treat as a local/foothold-gated escape.

An attacker with control of a FreeBSD jail (e.g. compromised jail-root or a service running inside it) plants a symlink such as the jail's /usr/local/etc pointing at the host's /etc, then waits. When the operator runs a routine Ansible copy/template/fetch task through the jailexec plugin, put_file resolves the destination on the host side and the root-privileged mkdir -p/mv follow the symlink, writing an attacker-chosen file as root on the host (e.g. /etc/cron.d entry or an authorized_keys), yielding host root. No public exploit code was identified, but the technique is fully described in the vendor advisory and patch.