CVE-2026-7246 is a command injection vulnerability in Pallets Click, specifically in the click.edit() function. Versions 8.3.2 and below are affected, allowing attackers with high privileges to inject arbitrary OS commands. The vulnerability is classified under CWE-77 and CWE-78. The CVSS 3.1 score is 7.2 (AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H), indicating a high-impact vulnerability requiring user interaction and high privileges to exploit. Red Hat advisories reference this vulnerability within their Ansible Automation Platform updates, indicating that fixes have been released in those packages.

Successful exploitation allows an attacker with high privileges to execute arbitrary commands on the operating system, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected system. The vulnerability affects the click.edit() function, which can be leveraged to run OS commands injected by an attacker. This can result in full system control or disruption of services.

Red Hat has published security advisories and errata addressing CVE-2026-7246 as part of updates to Red Hat Ansible Automation Platform 2.6 and related packages. Users should apply these official updates promptly to remediate the vulnerability. Since this is not a cloud service, remediation requires updating affected software versions. Patch status is not explicitly stated in the input data but vendor advisories indicate that fixes are available. Check the referenced Red Hat advisories for detailed update instructions.