CVE-2026-16493
Awaiting Analysis Awaiting Analysis - Queue

Command Injection in Ansible Core

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Red Hat, Inc.

Description
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-16493
EUVD
EUVD-2026-46336

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat ansible-core *
redhat ansible-core From 2.17 (inc) to 2.18 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an argument injection vulnerability in ansible-core's ansible-galaxy collection install feature. The _extract_collection_from_git() function constructs git clone commands without a '--' separator before user-supplied URLs. Attackers can craft malicious collection source URIs containing git argument injection payloads to execute arbitrary commands when a user runs 'ansible-galaxy collection install' with the malicious source.

Detection Guidance

Check for suspicious git clone commands in ansible-galaxy collection install logs. Look for unusual arguments or URLs containing command injection patterns like 'git+-ccore.sshCommand=' or similar payloads. Review ansible-core versions and update history for affected branches (devel, stable-2.18, stable-2.17).

Commands to check: grep -r 'ansible-galaxy collection install' /var/log/ or system logs. Check installed ansible-core version with ansible-galaxy --version or pip show ansible-core.

Impact Analysis

If you use ansible-galaxy to install collections from git sources, an attacker could trick you into running malicious commands on your system. This could lead to unauthorized code execution, data theft, or system compromise depending on your privileges. The attack requires user interaction (running the install command) but does not need special git configuration.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements like GDPR's data protection principles or HIPAA's security rules. Organizations using ansible-core may face compliance violations if this flaw enables data exposure or unauthorized system access.

Mitigation Strategies

Upgrade ansible-core to the latest patched version immediately. Avoid using untrusted collection sources. Temporarily disable ansible-galaxy collection install until patched. Monitor for unusual command execution in system logs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16493. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart