Ansible-Core git module argument injection (CVE-2026-84503)
CVE-2026-84503 Published on November 9, 2026

Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.

NVD

Vulnerability Analysis

CVE-2026-84503 can be exploited with local system access, requires user interaction and a small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
HIGH
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public. 61 days later.

Weakness Type

What is an Argument Injection Vulnerability?

The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

CVE-2026-84503 has been classified to as an Argument Injection vulnerability or weakness.


Products Associated with CVE-2026-84503

Want to know whenever a new CVE is published for Red Hat products? stack.watch will email you.

Red Hat Migration Toolkit Applications
Red Hat Migration Toolkit Virtualization
Red Hat Service Mesh
Red Hat Acm
Red Hat Ansible Automation Platform
Red Hat Ansible Core
Red Hat Certifications
Red Hat Discovery
Red Hat Enterprise Linux (RHEL)
Red Hat Openshift
Red Hat Openstack
Red Hat Satellite
Red Hat Rhui
Red Hat Ansible Portal
Red Hat Stf

Affected Versions

Red Hat Migration Toolkit for Applications 8: Red Hat Migration Toolkit for Virtualization: Red Hat OpenShift Service Mesh 3: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Advanced Cluster Management for Kubernetes 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform 2: Red Hat Ansible Automation Platform Ansible Core 2: Red Hat Ansible Automation Platform Ansible Core 2: Red Hat Ansible Automation Platform Ansible Core 2: Red Hat Ansible Automation Platform Ansible Core 2: Red Hat Certification Program for Red Hat Enterprise Linux 9: Red Hat Discovery 2: Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 8: Red Hat Enterprise Linux 9: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 5: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 17.1: Red Hat OpenStack Platform 18.0: Red Hat Satellite 6: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Self-service automation portal 2: Red Hat Service Telemetry Framework 1.5: Red Hat Service Telemetry Framework 1.5: