Command-Line Argument Vulnerability in Ansible Core by Red Hat
CVE-2026-71465
Key Information:
- Vendor
Red Hat
- Status
- Vendor
- CVE Published:
- 23 September 2026
What is CVE-2026-71465?
A vulnerability exists within Ansible Core's handling of command-line arguments where the function RunAdHocCommand.build_args() incorrectly appends a limit as a positional argument. This oversight allows for the possibility of command-line options being parsed unexpectedly, particularly if a limit starts with a '-', which could lead to misinterpretations as Ansible CLI options. Currently, this only affects short-circuit flags like --version and --help, but the risk escalates if future versions of Ansible Core default to a pattern that allows for more harmful injections.
Affected Version(s)
Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.33-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.33-1.el9ap
Red Hat Ansible Automation Platform 2.6 1789673739