CVE-2026-84503

ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository URL (e.g.

ansible-core

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host…

1. Nov 2026

Ausgewertete Quellen

• Red Hat
  https://access.redhat.com/errata/RHSA-2026:99950
• Red Hat
  https://access.redhat.com/errata/RHSA-2026:99952
• Red Hat
  https://access.redhat.com/security/cve/CVE-2026-84503
• Red Hat
  https://bugzilla.redhat.com/show_bug.cgi?id=2527098
• NVD
  CVE-2026-84503