For almost a year, my Ansible connection plugin for FreeBSD jails had a jail escape.

A symlink inside a jail, a root-owned mv on the host, and every file transfer could land wherever the jail wanted. Rejecting ".." didn't help at all.

Now it's CVE-2026-55074. Here's the bug, the fix, and what disclosing it looks like when the project has one maintainer.

https://blog.hofstede.it/my-ansible-plugin-had-a-jail-escape-cve-2026-55074/

#FreeBSD #Ansible #InfoSec #CVE #Jails #OpenSource #Security #SysAdmin