My Ansible Plugin Had a Jail Escape: CVE-2026-55074

At the end of last year I wrote about jailexec, my Ansible connection plugin that manages FreeBSD jails by SSHing to the jail host and running everything through jexec. That article has a section called Security Design. It proudly explains the two-stage file transfer: upload to a temporary location on the host, then move it into the jail with privilege escalation. That two-stage file transfer was a jail escape. Every release before 2.0.0 let a process with root inside a managed jail turn a routine Ansible file transfer into a root-owned write to an arbitrary directory on the jail host. It is now tracked as CVE-2026-55074 (GHSA-cxgv-hp74-jj7r). It was fixed in 2.0.0 on 2026-06-10. This article explains what went wrong, why the input validation I was quite pleased with did not help at all, and what the release and disclosure looked like for a small one-person project. To be clear about scope: this was a bug in my third-party plugin, not in ansible-core, the built-in ssh connection…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town