The vulnerability in Red Hat Ansible Automation Platform 2's ansible-core involves the _extract_collection_from_git() function in concrete_artifact_manager.py, which constructs git clone commands without using the '--' separator before user-supplied URLs. This improper neutralization of argument delimiters enables an attacker to inject malicious git arguments through a crafted collection source URI. When a user executes 'ansible-galaxy collection install' with such a URI, arbitrary command execution can occur. This vulnerability is a partial regression of CVE-2026-11332, which addressed a similar issue in the role install path but did not cover the collection install path. The CVSS v3.1 score is 7.8, reflecting high severity with local attack vector, low attack complexity, no privileges required, and user interaction needed. Confidentiality, integrity, and availability impacts are all high.

Successful exploitation allows an attacker to execute arbitrary commands on the system where 'ansible-galaxy collection install' is run with a malicious collection source URI. This can lead to full compromise of the affected system, including unauthorized disclosure, modification, or destruction of data and disruption of service.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-16493 for current remediation guidance. No official fix or temporary workaround is explicitly stated in the advisory content provided. Until a patch is available, avoid installing collections from untrusted or unauthenticated git sources to mitigate risk.