Skip to content
Fencer Vulns
high 7.8

CVE-2026-16493 json

Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)

published 2026-07-21 3 mo ago modified 2026-11-04 4 d ago also EUVD-2026-46336

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits
0
none known

Summary

A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.

Patch / fix

  • Red Hat Red Hat Satellite 6.17 for RHEL 9 1:2.16.19-1.el9sat
  • Red Hat Red Hat Satellite 6.18 for RHEL 9 0:1.3.1-5.el9pc, 0:3.73.30-3.el9pc, 1:2.16.19-1.el9sat
  • Red Hat Red Hat Satellite 6.19 for RHEL 9 1:2.16.19-1.el9sat
  • ansible Debian 14, Debian 13, Debian 12 5.4.0-1

debian advisories DEBIAN-CVE-2026-16493

  • rubygem-jwt satellite utils 6.19, satellite utils 6.18, satellite utils 6.17 +6 more 2.10.3-1.el9sat
  • ansible-core satellite maintenance 6.19, satellite maintenance 6.18, satellite maintenance 6.17 +6 more 1:2.16.19-1.el9sat
  • ansible-test satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +3 more 1:2.16.19-1.el9sat
  • openvox-server satellite capsule 6.19, satellite capsule 6.18, satellite capsule 6.17 +3 more 8.15.2-1.el9sat
  • python-aiohttp satellite capsule 6.17, satellite 6.17 3.14.3-1.el9pc
  • python3.11-aiohttp satellite capsule 6.17, satellite 6.17 3.14.3-1.el9pc
  • python3.12-aiohttp satellite capsule 6.19, satellite capsule 6.18, satellite 6.19 +1 more 3.14.3-1.el9pc
  • python3.12-gitpython satellite capsule 6.19, satellite 6.19 3.1.59-1.el9pc

red hat advisories RHSA-2026:63387RHSA-2026:63385RHSA-2026:63386

  • ansible-core SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +5 more 2.18.3-150400.9.17.1
  • ansible-core SLES 16.0, SLES for SAP applications 16.0 2.18.3-160000.4.1

suse advisories SUSE-SU-2026:4154-1SUSE-SU-2026:23704-1SUSE-SU-2026:23724-1

  • ansible-core-2.21 openSUSE Tumbleweed 2.21.6-1.1
  • ansible-core openSUSE Tumbleweed 2.21.4-2.1
  • ansible-core-2.18 openSUSE Tumbleweed 2.18.19-2.1
  • ansible-core-2.19 openSUSE Tumbleweed 2.19.13-2.1
  • ansible-core-2.20 openSUSE Tumbleweed 2.20.9-2.1
  • ansible-core openSUSE Leap 16.0 2.18.3-160000.4.1

opensuse advisories openSUSE-SU-2026:12451-1openSUSE-SU-2026:12052-1openSUSE-SU-2026:12053-1openSUSE-SU-2026:12054-1openSUSE-SU-2026:12055-1openSUSE-SU-2026:21828-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-16493 updated cvss 7.8

ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

  • Red Hat Ansible Automation Platform 2 ansible-core Red Hat Enterprise Linux 8 ansible-core, ansible-test Red Hat Enterprise Linux 9 ansible-core, ansible-test Red Hat Enterprise Linux 10 ansible-core
    affected: workaround, no fix available
  • Red Hat Satellite 6.17 for RHEL 9 ansible-core 2.16.19-1.el9sat, ansible-test 2.16.19-1.el9sat
    fixed: vendor fix RHSA-2026:63387
  • Red Hat Satellite 6.18 for RHEL 9 ansible-core 2.16.19-1.el9sat, ansible-test 2.16.19-1.el9sat, python3.12-pulpcore 3.73.30-3.el9pc, pulpcore-obsolete-packages 1.3.1-5.el9pc
    fixed: vendor fix RHSA-2026:63386
  • Red Hat Satellite 6.19 for RHEL 9 ansible-core 2.16.19-1.el9sat, ansible-test 2.16.19-1.el9sat
    fixed: vendor fix RHSA-2026:63385
  • Red Hat Satellite 6.17 for RHEL 9 foreman 3.14.0.20-1.el9sat, python-yarl 1.18.3-1.el9pc, satellite 6.17.11-1.el9sat, rubygem-jwt 2.10.3-1.el9sat, python-aiohttp 3.14.3-1.el9pc, foreman-cli 3.14.0.20-1.el9sat, +28 more Red Hat Satellite 6.18 for RHEL 9 satellite 6.18.9-1.el9sat, rubygem-jwt 2.10.3-1.el9sat, satellite-cli 6.18.9-1.el9sat, openvox-server 8.15.2-1.el9sat, satellite-common 6.18.9-1.el9sat, python3.12-aiohttp 3.14.3-1.el9pc, +8 more Red Hat Satellite 6.19 for RHEL 9 satellite 6.19.4-1.el9sat, foreman 3.18.0.10-1.el9sat, rubygem-jwt 2.10.3-1.el9sat, openvox-agent 8.28.1-1.el9sat, satellite-cli 6.19.4-1.el9sat, foreman-cli 3.18.0.10-1.el9sat, +25 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
3 mo ago

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Red Hat Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Red Hat Satellite 6.19 for RHEL 9
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9

Classification

Weakness
  • CWE-88 Improper Neutralization of Argument Delimiters in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.