Description (CNA)
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Satellite 6.17 for RHEL 9 | unaffected 1:2.16.19-1.el9sat before * |
| Red Hat / Red Hat Satellite 6.18 for RHEL 9 | unaffected 1:2.16.19-1.el9sat before * |
| Red Hat / Red Hat Satellite 6.18 for RHEL 9 | unaffected 0:1.3.1-5.el9pc before * |
| Red Hat / Red Hat Satellite 6.18 for RHEL 9 | unaffected 0:3.73.30-3.el9pc before * |
| Red Hat / Red Hat Satellite 6.19 for RHEL 9 | unaffected 1:2.16.19-1.el9sat before * |
| Red Hat / Red Hat Ansible Automation Platform 2 | affected |
| Red Hat / Red Hat Enterprise Linux 10 | affected |
| Red Hat / Red Hat Enterprise Linux 8 | affected |
| Red Hat / Red Hat Enterprise Linux 9 | affected |
CWE
CWE-88
References
- https://access.redhat.com/errata/RHSA-2026:63385
- https://access.redhat.com/errata/RHSA-2026:63386
- https://access.redhat.com/errata/RHSA-2026:63387
- https://access.redhat.com/security/cve/CVE-2026-16493
- https://bugzilla.redhat.com/show_bug.cgi?id=2503724
ADP enrichment
No English description supplied.
No references supplied.