Riskcovery

CVE-2026-16493

Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

State
Published
Severity
7.8 High
Published
Jul 21, 2026
Updated
Sep 4, 2026
Reserved
Jul 21, 2026

Read the record on cve.org

Description

A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hredhat

Weaknesses

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Affected Products

ProductVersions
Red Hat Satellite 6.17 for RHEL 9Red Hat
  • 1:2.16.19-1.el9sat and laterNot affected
Red Hat Satellite 6.18 for RHEL 9Red Hat
  • 1:2.16.19-1.el9sat and laterNot affected
Red Hat Satellite 6.18 for RHEL 9Red Hat
  • 0:1.3.1-5.el9pc and laterNot affected
Red Hat Satellite 6.18 for RHEL 9Red Hat
  • 0:3.73.30-3.el9pc and laterNot affected
Red Hat Satellite 6.19 for RHEL 9Red Hat
  • 1:2.16.19-1.el9sat and laterNot affected
Red Hat Ansible Automation Platform 2Red Hat
    Red Hat Enterprise Linux 10Red Hat
      Red Hat Enterprise Linux 8Red Hat
        Red Hat Enterprise Linux 9Red Hat

          References

          Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.