Answer in brief
CVE-2026-55074 records a High severity (CVSS 8.2) vulnerability in Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv). The current sources do not mark it as known exploited. The current feed maps chofstede/ansible_jailexec (generic), ansible-jailexec (pip), ansible-jailexec (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps chofstede/ansible_jailexec (generic), ansible-jailexec (pip), ansible-jailexec (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| chofstede/ansible_jailexecgeneric | <2.0.0 | 2.0.0 |
| ansible-jailexecpip | <2.0.0 | 2.0.0 |
| ansible-jailexecpypi | >=0 <2.0.0 | 2.0.0 |
Published upstream
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 13, 2026
Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and ran mkdir -p and mv there as root on the host. Those commands follow symbolic links, and the path was operated on outside the jail, so a symlink existing inside the jail was followed by the host-side, root-privileged mv. A party controlling content inside a managed jail (the jail's root, or any process able to create a symlink in a directory an Ansible task later writes to) can therefore cause an arbitrary root-owned write on the host, outside the jail — a full jail escape. Arbitrary root-owned host writes are readily escalated to host compromise (e.g. cron, rc.d, authorized_keys). Preconditions for this vulnerability are that the operator runs a copy/template/fetch-style task (anything using put_file) against the jail, and the attacker can place a symlink inside the jail at or above the task's destination before the transfer runs. This issue has been fixed in version 2.0.0.
Quoted source text, attributed separately from HOL analysis.