CVE-2026-84503 PUBLISHED

Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce

Assigner: redhat
Reserved: 01.09.2026 Published: 09.11.2026 Updated: 09.11.2026

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.

Metrics

CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS Score: 6.7

Product Status

Vendor Red Hat
Product Migration Toolkit for Applications 8
Versions Default: affected
Vendor Red Hat
Product Migration Toolkit for Virtualization
Versions Default: affected
Vendor Red Hat
Product OpenShift Service Mesh 3
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Advanced Cluster Management for Kubernetes 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Advanced Cluster Management for Kubernetes 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform Ansible Core 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform Ansible Core 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform Ansible Core 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Ansible Automation Platform Ansible Core 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Certification Program for Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat Discovery 2
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Versions Default: affected
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenShift Container Platform 5
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenStack Platform 17.1
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenStack Platform 17.1
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenStack Platform 17.1
Versions Default: affected
Vendor Red Hat
Product Red Hat OpenStack Platform 18.0
Versions Default: affected
Vendor Red Hat
Product Red Hat Satellite 6
Versions Default: affected
Vendor Red Hat
Product Red Hat Update Infrastructure 5
Versions Default: affected
Vendor Red Hat
Product Red Hat Update Infrastructure 5
Versions Default: unaffected
Vendor Red Hat
Product Red Hat Update Infrastructure 5
Versions Default: affected
Vendor Red Hat
Product Red Hat Update Infrastructure 5
Versions Default: unaffected
Vendor Red Hat
Product Self-service automation portal 2
Versions Default: affected
Vendor Red Hat
Product Service Telemetry Framework 1.5
Versions Default: unaffected
Vendor Red Hat
Product Service Telemetry Framework 1.5
Versions Default: unaffected

References

Problem Types

  • Improper Neutralization of Argument Delimiters in a Command CWE