Command-Line Argument Vulnerability in Ansible Core by Red Hat
CVE-2026-71465

3.1LOW

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Vendor
CVE Published:
23 September 2026

What is CVE-2026-71465?

A vulnerability exists within Ansible Core's handling of command-line arguments where the function RunAdHocCommand.build_args() incorrectly appends a limit as a positional argument. This oversight allows for the possibility of command-line options being parsed unexpectedly, particularly if a limit starts with a '-', which could lead to misinterpretations as Ansible CLI options. Currently, this only affects short-circuit flags like --version and --help, but the risk escalates if future versions of Ansible Core default to a pattern that allows for more harmful injections.

References

https://access.redhat.com/security/cve/CVE-2026-71465
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2512375
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Chris Meyers (Red Hat).
.