CVE-2026-16493
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
In ansible-core, the _extract_collection_from_git() function in concrete_artifact_manager.py constructs git clone commands without a '--' separator before user-supplied URLs. An attacker can provide a malicious collection source URI containing git argument injection, leading to arbitrary command execution during collection installation.
Risk Assessment
Arbitrary command execution on the user's host can lead to full system compromise, including data theft and malware installation.
Recommendation
Upgrade ansible-core to a version containing the fix for CVE-2026-16493 and avoid installing collections from untrusted sources.
Other vulnerabilities in ansible-core
See all- CVE-2026-11332High
A flaw in ansible-core: the ansible-galaxy role install command processes dependency specifications from meta/requirements.yml. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags via the src field, allowing arbitrary code execution on the machine of a user who installs the role.
- CVE-2024-11079Medium
A flaw in Ansible-Core allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content, leading to arbitrary code execution.
Original NVD description (English source)
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.