A flaw was found in ansible-core. (CVE-2026-16493)

The vulnerability (CVE-2026-16493) in ansible-core arises from the _extract_collection_from_git() function in concrete_artifact_manager.py, which constructs git clone commands without including the '--' end-of-options separator before user-supplied URLs. This omission enables an attacker to inject arbitrary git command arguments via a crafted collection source URI, leading to arbitrary command execution when 'ansible-galaxy collection install' is run. This vulnerability is an incomplete fix of CVE-2026-11332, which addressed a similar argument injection issue in the role install path but missed the collection install code path. The issue has been rated with a CVSS 3.1 score of 7.8 (high severity) with impact on confidentiality, integrity, and availability. Red Hat Satellite 6.18 and 6.19 updates include patches that fix this vulnerability. The vendor advisory explicitly lists this fix and provides instructions for applying the update.

Successful exploitation allows an attacker to execute arbitrary commands on the system where 'ansible-galaxy collection install' is run with a malicious collection source URI. This can lead to full compromise of the affected system, impacting confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS score of 7.8. There are no known exploits in the wild at the time of the advisory.

Red Hat has released official patches for this vulnerability in ansible-core as part of Red Hat Satellite 6.18 and 6.19 updates. Users should apply these updates promptly to remediate the issue. The vendor advisory provides detailed instructions for updating affected systems. No additional mitigations are specified beyond applying the official fixes.