invokes git (ls-remote, clone, fetch) with the repository URL as a positional
argument and without a "--" separator, so a repository URL that begins with a
dash is interpreted by git as a command-line option. A caller that passes an
attacker-controlled repository URL to the module can trigger argument
injection (for example --upload-pack/--exec), resulting in arbitrary command
execution on the host running the module.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
|
Redhat
Subscribe
|
Acm
Subscribe
Ansible Automation Platform
Subscribe
Ansible Core
Subscribe
Ansible Portal
Subscribe
Certifications
Subscribe
Discovery
Subscribe
Enterprise Linux
Subscribe
Migration Toolkit Applications
Subscribe
Migration Toolkit Virtualization
Subscribe
Openshift
Subscribe
Openstack
Subscribe
Rhui
Subscribe
Satellite
Subscribe
Service Mesh
Subscribe
Stf
Subscribe
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Mon, 09 Nov 2026 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module. | |
| Title | Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce | |
| First Time appeared |
Redhat
Redhat acm Redhat ansible Automation Platform Redhat ansible Core Redhat ansible Portal Redhat certifications Redhat discovery Redhat enterprise Linux Redhat migration Toolkit Applications Redhat migration Toolkit Virtualization Redhat openshift Redhat openstack Redhat rhui Redhat satellite Redhat service Mesh Redhat stf |
|
| Weaknesses | CWE-88 | |
| CPEs | cpe:/a:redhat:acm:2 cpe:/a:redhat:ansible_automation_platform:2 cpe:/a:redhat:ansible_core:2 cpe:/a:redhat:ansible_portal:2 cpe:/a:redhat:certifications:9 cpe:/a:redhat:discovery:2::el8 cpe:/a:redhat:enterprise_linux:10 cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/a:redhat:migration_toolkit_applications:8 cpe:/a:redhat:migration_toolkit_virtualization:2 cpe:/a:redhat:openshift:4 cpe:/a:redhat:openshift:5 cpe:/a:redhat:openstack:17.1 cpe:/a:redhat:openstack:18.0 cpe:/a:redhat:rhui:5::el9 cpe:/a:redhat:satellite:6 cpe:/a:redhat:service_mesh:3 cpe:/a:redhat:stf:1.5 |
|
| Vendors & Products |
Redhat
Redhat acm Redhat ansible Automation Platform Redhat ansible Core Redhat ansible Portal Redhat certifications Redhat discovery Redhat enterprise Linux Redhat migration Toolkit Applications Redhat migration Toolkit Virtualization Redhat openshift Redhat openstack Redhat rhui Redhat satellite Redhat service Mesh Redhat stf |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2026-11-09T17:57:01.391Z
Reserved: 2026-09-01T21:05:02.720Z
Link: CVE-2026-84503
Vulnrichment
No data.
NVD
Status : Awaiting Analysis
Published: 2026-11-09T18:17:34.233
Modified: 2026-11-09T18:17:34.377
Link: CVE-2026-84503
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-11-09T19:45:15Z