The vulnerability in ansible-core's concrete_artifact_manager.py involves the _extract_collection_from_git() function constructing git clone commands without the '--' end-of-options separator before user-supplied URLs. This omission enables an attacker to craft a collection source URI containing git argument injection payloads, which can be executed when a user runs 'ansible-galaxy collection install' with the malicious source. The flaw is a partial regression of CVE-2026-11332, which addressed a similar issue in the role install path but did not cover the collection install path. The CVSS 3.1 score is 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to execute arbitrary commands on the system with the privileges of the user running 'ansible-galaxy collection install'. This can lead to full compromise of the affected system, including unauthorized access, data modification, and service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The Red Hat advisory linked does not explicitly state a fix or workaround at this time. Users should monitor the Red Hat advisory page for updates and avoid installing collections from untrusted sources until a fix is available.