CVE-2026-16493: Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-21 · updated 2026-09-04
Weakness: CWE-88

Description

A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.

Affected products

Red Hat Ansible Automation Platform 2: all versions
Red Hat Enterprise Linux 10: all versions
Red Hat Enterprise Linux 8: all versions
Red Hat Enterprise Linux 9: all versions
Red Hat Satellite 6.17 for RHEL 9: all versions — fixed in 1:2.16.19-1.el9sat
Red Hat Satellite 6.18 for RHEL 9: all versions — fixed in 0:1.3.1-5.el9pc, 0:3.73.30-3.el9pc, 1:2.16.19-1.el9sat
Red Hat Satellite 6.19 for RHEL 9: all versions — fixed in 1:2.16.19-1.el9sat

How to fix

Upgrade to a fixed version: Red Hat Satellite 6.17 for RHEL 9 1:2.16.19-1.el9sat; Red Hat Satellite 6.18 for RHEL 9 0:1.3.1-5.el9pc, 0:3.73.30-3.el9pc, 1:2.16.19-1.el9sat; Red Hat Satellite 6.19 for RHEL 9 1:2.16.19-1.el9sat. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-16493 or the next vulnerability affects your stack