CVE-2026-16493
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
In ansible-core, the _extract_collection_from_git() function in concrete_artifact_manager.py constructs git clone commands without a '--' separator before user-supplied URLs. An attacker can provide a malicious collection source URI containing git argument injection, leading to arbitrary command execution during collection installation.
Risk Assessment
Arbitrary command execution on the user's host can lead to full system compromise, including data theft and malware installation.
Recommendation
Upgrade ansible-core to a version containing the fix for CVE-2026-16493 and avoid installing collections from untrusted sources.
Other vulnerabilities in ansible-core
See all- CVE-2026-89091High
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory.
- CVE-2026-71465Low
RunAdHocCommand.build_args() appends limit as a bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since the injected element displaces the required pattern positional. Would escalate if ansible-core ever defaults pattern.
- CVE-2026-11332High
A flaw in ansible-core: the ansible-galaxy role install command processes dependency specifications from meta/requirements.yml. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags via the src field, allowing arbitrary code execution on the machine of a user who installs the role.
- CVE-2024-11079Medium
A flaw in Ansible-Core allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content, leading to arbitrary code execution.
Original NVD description (English source)
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS