CVE-2026-16493
Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
- Record
CVE-2026-16493- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-04
EUVDEUVD-2026-46336
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
- Record
EUVD-2026-46336- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-m37p-hmh2-w6j2
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's...
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
- Record
GHSA-m37p-hmh2-w6j2- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-02
NVD
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
- Record
CVE-2026-16493- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-04
OSVDEBIAN-CVE-2026-16493
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
- Record
DEBIAN-CVE-2026-16493- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
OSVRHSA-2026:63385
Red Hat Security Advisory: Satellite 6.19.4 Async Update
- Record
RHSA-2026:63385- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 13 moreShow less
OSVRHSA-2026:63386
Red Hat Security Advisory: Satellite 6.18.9 Async Update
- Record
RHSA-2026:63386- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:63387
Red Hat Security Advisory: Satellite 6.17.11 Async Update
- Record
RHSA-2026:63387- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-16493
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
- Record
UBUNTU-CVE-2026-16493- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-93102 No score
CVE-2026-16493 affecting package ansible 2.17.11-1
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
- Record
AZL-93102- Updated
- 2026-11-05
OSVopenSUSE-SU-2026:12052-1 No score
ansible-core-2.21.4-2.1 on GA media
These are all security issues fixed in the ansible-core-2.21.4-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12052-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12053-1 No score
ansible-core-2.18-2.18.19-2.1 on GA media
These are all security issues fixed in the ansible-core-2.18-2.18.19-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12053-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12054-1 No score
ansible-core-2.19-2.19.13-2.1 on GA media
These are all security issues fixed in the ansible-core-2.19-2.19.13-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12054-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12055-1 No score
ansible-core-2.20-2.20.9-2.1 on GA media
These are all security issues fixed in the ansible-core-2.20-2.20.9-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12055-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12451-1 No score
ansible-core-2.21-2.21.6-1.1 on GA media
These are all security issues fixed in the ansible-core-2.21-2.21.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12451-1- Updated
- 2026-11-07
OSVopenSUSE-SU-2026:21828-1 No score
Security update for ansible-core
This update for ansible-core fixes the following issues:
- CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone (bsc#1272369).
- Record
openSUSE-SU-2026:21828-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23704-1 No score
Security update for ansible-core
This update for ansible-core fixes the following issues:
- CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone (bsc#1272369).
- Record
SUSE-SU-2026:23704-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23724-1 No score
Security update for ansible-core
This update for ansible-core fixes the following issues:
- CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone (bsc#1272369).
- Record
SUSE-SU-2026:23724-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:4154-1 No score
Security update for ansible-core
This update for ansible-core fixes the following issues:
- CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone (bsc#1272369).
- Record
SUSE-SU-2026:4154-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ansibleAzure Linux:3 |
through 2.17.11-1 | None known |
ansibleDebian:12 |
before 5.4.0-1 | 5.4.0-1 |
ansibleDebian:13 |
before 5.4.0-1 | 5.4.0-1 |
ansibleDebian:14 |
before 5.4.0-1 | 5.4.0-1 |
ansible-coreDebian:12 |
All versions, plus listed versions 2.14.10-12.14.11-12.14.11-22.14.13-12.14.16-0+deb12u1 Show 45 moreShow less2.14.18-0+deb12u12.14.18-0+deb12u22.14.3-12.14.6-12.14.7-12.14.8-12.14.9-12.14.9-22.16.5-12.16.6-12.17.0-12.17.1-12.17.2-12.17.3-12.17.5-12.17.5-22.17.5-32.17.5-42.17.5-52.18.0-12.18.0-22.18.1-12.18.1-22.18.1-32.18.1-42.18.3-12.19.0-12.19.0~beta1-12.19.0~beta1-22.19.0~beta2-12.19.0~beta4-12.19.0~beta5-12.19.0~beta6-12.19.0~rc2-12.19.1-12.19.2-12.19.3-12.19.3-22.19.4-12.19~pre20250506~462affa7c4-12.19~pre20250510~5347d4d4fc-12.20.1-12.20.3-12.21.0-12.21.1~rc1-1 |
None known |
ansible-coreDebian:13 |
All versions, plus listed versions 2.19.0-12.19.0~beta6-12.19.0~rc2-12.19.1-0+deb13u12.19.1-1 Show 14 moreShow less2.19.11-0+deb13u12.19.2-12.19.3-12.19.3-22.19.4-0+deb13u12.19.4-12.20.1-12.20.3-12.21.0-12.21.1~rc1-12.21.1~rc1-22.21.2-12.22.0~beta1-12.22.0~beta2-1 |
None known |
ansible-coreDebian:14 |
All versions, plus listed versions 2.19.0-12.19.0~beta6-12.19.0~rc2-12.19.1-12.19.2-1 Show 11 moreShow less2.19.3-12.19.3-22.19.4-12.20.1-12.20.3-12.21.0-12.21.1~rc1-12.21.1~rc1-22.21.2-12.22.0~beta1-12.22.0~beta2-1 |
None known |
openvox-serverRed Hat:satellite_capsule:6.19::el9 From an advisory covering 22 CVEs |
before 0:8.15.2-1.el9sat | 0:8.15.2-1.el9sat |
openvox-serverRed Hat:satellite:6.19::el9 From an advisory covering 22 CVEs |
before 0:8.15.2-1.el9sat | 0:8.15.2-1.el9sat |
ansible-coreRed Hat:satellite_capsule:6.19::el9 From an advisory covering 22 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
Show 81 moreShow less
| Package | Affected | Fixed |
|---|---|---|
ansible-testRed Hat:satellite_capsule:6.19::el9 From an advisory covering 22 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
ansible-coreRed Hat:satellite_maintenance:6.19::el9 From an advisory covering 22 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
ansible-coreRed Hat:satellite:6.19::el9 From an advisory covering 22 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
ansible-testRed Hat:satellite:6.19::el9 From an advisory covering 22 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
python3.12-aiohttpRed Hat:satellite_capsule:6.19::el9 From an advisory covering 22 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-aiohttp-debuginfoRed Hat:satellite_capsule:6.19::el9 From an advisory covering 22 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-aiohttp-debugsourceRed Hat:satellite_capsule:6.19::el9 From an advisory covering 22 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-aiohttpRed Hat:satellite:6.19::el9 From an advisory covering 22 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-aiohttp-debuginfoRed Hat:satellite:6.19::el9 From an advisory covering 22 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-aiohttp-debugsourceRed Hat:satellite:6.19::el9 From an advisory covering 22 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-gitpythonRed Hat:satellite_capsule:6.19::el9 From an advisory covering 22 CVEs |
before 0:3.1.59-1.el9pc | 0:3.1.59-1.el9pc |
python3.12-gitpythonRed Hat:satellite:6.19::el9 From an advisory covering 22 CVEs |
before 0:3.1.59-1.el9pc | 0:3.1.59-1.el9pc |
rubygem-jwtRed Hat:satellite_capsule:6.19::el9 From an advisory covering 22 CVEs |
before 0:2.10.3-1.el9sat | 0:2.10.3-1.el9sat |
rubygem-jwtRed Hat:satellite_utils:6.19::el9 From an advisory covering 22 CVEs |
before 0:2.10.3-1.el9sat | 0:2.10.3-1.el9sat |
rubygem-jwtRed Hat:satellite:6.19::el9 From an advisory covering 22 CVEs |
before 0:2.10.3-1.el9sat | 0:2.10.3-1.el9sat |
openvox-serverRed Hat:satellite_capsule:6.18::el9 From an advisory covering 9 CVEs |
before 0:8.15.2-1.el9sat | 0:8.15.2-1.el9sat |
pulpcore-obsolete-packagesRed Hat:satellite_capsule:6.18::el9 From an advisory covering 9 CVEs |
before 0:1.3.1-5.el9pc | 0:1.3.1-5.el9pc |
python3.12-pulpcoreRed Hat:satellite_capsule:6.18::el9 From an advisory covering 9 CVEs |
before 0:3.73.30-3.el9pc | 0:3.73.30-3.el9pc |
openvox-serverRed Hat:satellite:6.18::el9 From an advisory covering 9 CVEs |
before 0:8.15.2-1.el9sat | 0:8.15.2-1.el9sat |
pulpcore-obsolete-packagesRed Hat:satellite:6.18::el9 From an advisory covering 9 CVEs |
before 0:1.3.1-5.el9pc | 0:1.3.1-5.el9pc |
python3.12-pulpcoreRed Hat:satellite:6.18::el9 From an advisory covering 9 CVEs |
before 0:3.73.30-3.el9pc | 0:3.73.30-3.el9pc |
ansible-coreRed Hat:satellite_capsule:6.18::el9 From an advisory covering 9 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
ansible-testRed Hat:satellite_capsule:6.18::el9 From an advisory covering 9 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
ansible-coreRed Hat:satellite_maintenance:6.18::el9 From an advisory covering 9 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
ansible-coreRed Hat:satellite:6.18::el9 From an advisory covering 9 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
ansible-testRed Hat:satellite:6.18::el9 From an advisory covering 9 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
python3.12-aiohttpRed Hat:satellite_capsule:6.18::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-aiohttp-debuginfoRed Hat:satellite_capsule:6.18::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-aiohttp-debugsourceRed Hat:satellite_capsule:6.18::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-aiohttpRed Hat:satellite:6.18::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-aiohttp-debuginfoRed Hat:satellite:6.18::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.12-aiohttp-debugsourceRed Hat:satellite:6.18::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
rubygem-jwtRed Hat:satellite_capsule:6.18::el9 From an advisory covering 9 CVEs |
before 0:2.10.3-1.el9sat | 0:2.10.3-1.el9sat |
rubygem-jwtRed Hat:satellite_utils:6.18::el9 From an advisory covering 9 CVEs |
before 0:2.10.3-1.el9sat | 0:2.10.3-1.el9sat |
rubygem-jwtRed Hat:satellite:6.18::el9 From an advisory covering 9 CVEs |
before 0:2.10.3-1.el9sat | 0:2.10.3-1.el9sat |
ansible-coreRed Hat:satellite_capsule:6.17::el9 From an advisory covering 9 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
ansible-testRed Hat:satellite_capsule:6.17::el9 From an advisory covering 9 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
openvox-serverRed Hat:satellite_capsule:6.17::el9 From an advisory covering 9 CVEs |
before 0:8.15.2-1.el9sat | 0:8.15.2-1.el9sat |
ansible-coreRed Hat:satellite_maintenance:6.17::el9 From an advisory covering 9 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
ansible-coreRed Hat:satellite:6.17::el9 From an advisory covering 9 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
ansible-testRed Hat:satellite:6.17::el9 From an advisory covering 9 CVEs |
before 1:2.16.19-1.el9sat | 1:2.16.19-1.el9sat |
openvox-serverRed Hat:satellite:6.17::el9 From an advisory covering 9 CVEs |
before 0:8.15.2-1.el9sat | 0:8.15.2-1.el9sat |
python-aiohttpRed Hat:satellite_capsule:6.17::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python-aiohttp-debugsourceRed Hat:satellite_capsule:6.17::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.11-aiohttpRed Hat:satellite_capsule:6.17::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.11-aiohttp-debuginfoRed Hat:satellite_capsule:6.17::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python-aiohttpRed Hat:satellite:6.17::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python-aiohttp-debugsourceRed Hat:satellite:6.17::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.11-aiohttpRed Hat:satellite:6.17::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
python3.11-aiohttp-debuginfoRed Hat:satellite:6.17::el9 From an advisory covering 9 CVEs |
before 0:3.14.3-1.el9pc | 0:3.14.3-1.el9pc |
rubygem-jwtRed Hat:satellite_capsule:6.17::el9 From an advisory covering 9 CVEs |
before 0:2.10.3-1.el9sat | 0:2.10.3-1.el9sat |
rubygem-jwtRed Hat:satellite_utils:6.17::el9 From an advisory covering 9 CVEs |
before 0:2.10.3-1.el9sat | 0:2.10.3-1.el9sat |
rubygem-jwtRed Hat:satellite:6.17::el9 From an advisory covering 9 CVEs |
before 0:2.10.3-1.el9sat | 0:2.10.3-1.el9sat |
ansible-coreSUSE:Linux Enterprise Server 16.0 From an advisory covering 2 CVEs |
before 2.18.3-160000.4.1 | 2.18.3-160000.4.1 |
ansible-coreSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 2 CVEs |
before 2.18.3-160000.4.1 | 2.18.3-160000.4.1 |
ansible-coreSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 2 CVEs |
before 2.18.3-150400.9.17.1 | 2.18.3-150400.9.17.1 |
ansible-coreSUSE:Linux Enterprise Module for Systems Management 15 SP7 From an advisory covering 2 CVEs |
before 2.18.3-150400.9.17.1 | 2.18.3-150400.9.17.1 |
ansible-coreSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 2 CVEs |
before 2.18.3-150400.9.17.1 | 2.18.3-150400.9.17.1 |
ansible-coreSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 2 CVEs |
before 2.18.3-150400.9.17.1 | 2.18.3-150400.9.17.1 |
ansible-coreSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 2 CVEs |
before 2.18.3-150400.9.17.1 | 2.18.3-150400.9.17.1 |
ansible-coreSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 2 CVEs |
before 2.18.3-150400.9.17.1 | 2.18.3-150400.9.17.1 |
ansible-coreSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 2 CVEs |
before 2.18.3-150400.9.17.1 | 2.18.3-150400.9.17.1 |
ansible-coreSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 2 CVEs |
before 2.18.3-150400.9.17.1 | 2.18.3-150400.9.17.1 |
ansibleUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.1+dfsg-11.3.4+dfsg-11.4.0+dfsg-11.4.1+dfsg-11.4.3+dfsg-1 Show 5 moreShow less1.4.4+dfsg-11.5.4+dfsg-11.5.4+dfsg-1ubuntu0.1~esm11.5.4+dfsg-1ubuntu0.1~esm21.5.4+dfsg-1ubuntu0.1~esm3 |
None known |
ansibleUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.9.2+dfsg-21.9.4-12.0.0.2-22.0.0.2-2ubuntu12.0.0.2-2ubuntu1.1 Show 8 moreShow less2.0.0.2-2ubuntu1.22.0.0.2-2ubuntu1.32.0.0.2-2ubuntu1.3+esm12.0.0.2-2ubuntu1.3+esm22.0.0.2-2ubuntu1.3+esm32.0.0.2-2ubuntu1.3+esm42.0.0.2-2ubuntu1.3+esm52.0.0.2-2ubuntu1.3+esm6 |
None known |
ansibleUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.3.1.0+dfsg-22.5.0+dfsg-12.5.1+dfsg-12.5.1+dfsg-1ubuntu0.12.5.1+dfsg-1ubuntu0.1+esm1 Show 4 moreShow less2.5.1+dfsg-1ubuntu0.1+esm22.5.1+dfsg-1ubuntu0.1+esm32.5.1+dfsg-1ubuntu0.1+esm42.5.1+dfsg-1ubuntu0.1+esm5 |
None known |
ansibleUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.8.3+dfsg-12.8.6+dfsg-12.9.2+dfsg-12.9.4+dfsg-12.9.6+dfsg-12.9.6+dfsg-1ubuntu0.1~esm12.9.6+dfsg-1ubuntu0.1~esm22.9.6+dfsg-1ubuntu0.1~esm3 |
None known |
ansible-coreUbuntu:22.04:LTS |
All versions, plus listed versions 2.12.0-12.12.0-1ubuntu0.1 |
None known |
ansibleUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.10.7+merged+base+2.10.8+dfsg-12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm12.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4 |
None known |
ansibleUbuntu:24.04:LTS |
All versions, plus listed versions 7.7.0+dfsg-17.7.0+dfsg-39.2.0+dfsg-0ubuntu49.2.0+dfsg-0ubuntu5 |
None known |
ansible-coreUbuntu:24.04:LTS |
All versions, plus listed versions 2.14.9-22.14.11-12.14.11-22.14.13-12.16.3-0ubuntu12.16.3-0ubuntu2 |
None known |
ansibleUbuntu:26.10 |
All versions, plus listed versions 13.1.0+dfsg-1ubuntu113.4.0+dfsg-1 |
None known |
ansible-coreUbuntu:26.10 |
All versions, plus listed versions 2.20.1-12.21.1~rc1-12.21.1~rc1-22.21.1~rc1-2ubuntu12.22.0~beta2-1 |
None known |
ansibleUbuntu:26.04:LTS |
All versions, plus listed versions 12.0.0~b1+dfsg-112.0.0+dfsg-112.2.0+dfsg-113.1.0+dfsg-113.1.0+dfsg-1ubuntu1 |
None known |
ansible-coreUbuntu:26.04:LTS |
All versions, plus listed versions 2.19.0-1ubuntu12.19.4-12.20.1-1 |
None known |
ansible-coreopenSUSE:Tumbleweed |
before 2.21.4-2.1 | 2.21.4-2.1 |
ansible-core-2.18openSUSE:Tumbleweed |
before 2.18.19-2.1 | 2.18.19-2.1 |
ansible-core-2.19openSUSE:Tumbleweed |
before 2.19.13-2.1 | 2.19.13-2.1 |
ansible-core-2.20openSUSE:Tumbleweed |
before 2.20.9-2.1 | 2.20.9-2.1 |
ansible-core-2.21openSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 2.21.6-1.1 | 2.21.6-1.1 |
ansible-coreopenSUSE:Leap 16.0 From an advisory covering 2 CVEs |
before 2.18.3-160000.4.1 | 2.18.3-160000.4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected | ||
| affected | EUVD, NVD, OSV | |
| facts | CVE List, EUVD | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-16493 is a high vulnerability (CVSS 7.8) in Red Hat Ansible Automation Platform 2, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 18th percentile. Fixed in ansible 5.4.0-1.
References
access.redhat.com/errata/RHSA-2026:63385
bugzilla.redhat.com/show_bug.cgi?id=2503724
nvd.nist.gov/vuln/detail/CVE-2026-16493
Show 180 moreShow less
github.com/advisories/GHSA-m37p-hmh2-w6j2
security-tracker.debian.org/tracker/CVE-2026-16493
issues.redhat.com/browse/SAT-45592
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_63385.json
cve.org/CVERecord?id=CVE-2026-10051
gitlab.eclipse.org/security/cve-assignment/-/work_items/119
vulncheck.com/advisories/gitpython-before-arbitrary-file-overwrite-and-read
suse.com/support/update/announcement/2026/suse-su-202623704-1
bugzilla.suse.com/1272369
ubuntu.com/security/CVE-2026-16493
Left out here: 4 versions. The JSON record has them.