The vulnerability arises because RunAdHocCommand.build_args() appends the 'limit' parameter directly to the argument list instead of using a safer method that explicitly specifies the '-l' option. If the 'limit' value starts with a dash, it is parsed as an Ansible CLI option, which can lead to argument injection. At present, this injection is limited to short-circuit flags such as --version and --help because the injected argument displaces the required pattern positional argument. The issue could escalate if ansible-core changes its default pattern behavior. The vulnerability is classified under CWE-88 (Improper Neutralization of Argument Delimiters in a Command).

An attacker with low privileges could inject CLI arguments into Ansible commands via the 'limit' parameter, potentially altering execution logic or causing unintended behavior. The current impact is limited to integrity with low severity, as only short-circuit flags are injectable, and no confidentiality or availability impact is reported.

As of the latest Red Hat advisory, no explicit fix or patch is mentioned. Patch status is not yet confirmed—check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-71465 for current remediation guidance. Users should monitor the advisory for updates and consider restricting input to the 'limit' parameter to prevent injection of CLI options.