My Ansible Plugin Had a Jail Escape: CVE-2026-55074

At the end of last year I wrote about jailexec, my Ansible connection plugin that manages FreeBSD jails by SSHing to the jail host and running everything through jexec. That article has a section called Security Design. It proudly explains the two-stage file transfer: upload to a temporary location on the host, then move it into the jail with privilege escalation. That two-stage file transfer was a jail escape. Every release before 2.0.0 let a process with root inside a managed jail turn a routine Ansible file transfer into a root-owned write to an arbitrary directory on the jail host. It is now tracked as CVE-2026-55074 (GHSA-cxgv-hp74-jj7r). It was fixed in 2.0.0 on 2026-06-10. This article explains what went wrong, why the input validation I was quite pleased with did not help at all, and what the release and disclosure looked like for a small one-person project. To be clear about scope: this was a bug in my third-party plugin, not in ansible-core, the built-in ssh connection…