CVE-2026-84503
Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
CVE List Score used
Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
- Record
CVE-2026-84503- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-09
EUVDEUVD-2026-120161
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
- Record
EUVD-2026-120161- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-09
GitHub AdvisoriesGHSA-537w-5jw6-89cf
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote,...
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
- Record
GHSA-537w-5jw6-89cf- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-09
NVD
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
- Record
CVE-2026-84503- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-88
- Updated
- 2026-11-09
OSVDEBIAN-CVE-2026-84503
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
- Record
DEBIAN-CVE-2026-84503- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-10
OSVopenSUSE-SU-2026:12448-1 No score
ansible-core-2.21.6-1.1 on GA media
These are all security issues fixed in the ansible-core-2.21.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12448-1- Updated
- 2026-11-07
OSVopenSUSE-SU-2026:12449-1 No score
ansible-core-2.19-2.19.15-1.1 on GA media
These are all security issues fixed in the ansible-core-2.19-2.19.15-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12449-1- Updated
- 2026-11-07
OSVopenSUSE-SU-2026:12450-1 No score
ansible-core-2.20-2.20.11-1.1 on GA media
These are all security issues fixed in the ansible-core-2.20-2.20.11-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12450-1- Updated
- 2026-11-07
OSVopenSUSE-SU-2026:12451-1 No score
ansible-core-2.21-2.21.6-1.1 on GA media
These are all security issues fixed in the ansible-core-2.21-2.21.6-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12451-1- Updated
- 2026-11-07
Affected products
- red hat migration toolkit for applications 8
- red hat migration toolkit for virtualization
- red hat openshift service mesh 3
- red hat advanced cluster management for kubernetes 2
- red hat ansible automation platform 2
- red hat ansible automation platform ansible core 2
- red hat certification program for red hat enterprise linux 9
- red hat discovery 2
- red hat enterprise linux 10
- red hat enterprise linux 8
- red hat enterprise linux 9
- red hat openshift container platform 4
Affected packages
| Package | Affected | Fixed |
|---|---|---|
ansible-coreDebian:12 |
All versions, plus listed versions 2.14.10-12.14.11-12.14.11-22.14.13-12.14.16-0+deb12u1 Show 45 moreShow less2.14.18-0+deb12u12.14.18-0+deb12u22.14.3-12.14.6-12.14.7-12.14.8-12.14.9-12.14.9-22.16.5-12.16.6-12.17.0-12.17.1-12.17.2-12.17.3-12.17.5-12.17.5-22.17.5-32.17.5-42.17.5-52.18.0-12.18.0-22.18.1-12.18.1-22.18.1-32.18.1-42.18.3-12.19.0-12.19.0~beta1-12.19.0~beta1-22.19.0~beta2-12.19.0~beta4-12.19.0~beta5-12.19.0~beta6-12.19.0~rc2-12.19.1-12.19.2-12.19.3-12.19.3-22.19.4-12.19~pre20250506~462affa7c4-12.19~pre20250510~5347d4d4fc-12.20.1-12.20.3-12.21.0-12.21.1~rc1-1 |
None known |
ansible-coreDebian:13 |
All versions, plus listed versions 2.19.0-12.19.0~beta6-12.19.0~rc2-12.19.1-0+deb13u12.19.1-1 Show 15 moreShow less2.19.11-0+deb13u12.19.2-12.19.3-12.19.3-22.19.4-0+deb13u12.19.4-12.20.1-12.20.3-12.21.0-12.21.1~rc1-12.21.1~rc1-22.21.2-12.22.0-12.22.0~beta1-12.22.0~beta2-1 |
None known |
ansible-coreDebian:14 |
All versions, plus listed versions 2.19.0-12.19.0~beta6-12.19.0~rc2-12.19.1-12.19.2-1 Show 12 moreShow less2.19.3-12.19.3-22.19.4-12.20.1-12.20.3-12.21.0-12.21.1~rc1-12.21.1~rc1-22.21.2-12.22.0-12.22.0~beta1-12.22.0~beta2-1 |
None known |
ansible-coreopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.21.6-1.1 | 2.21.6-1.1 |
ansible-core-2.19openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.19.15-1.1 | 2.19.15-1.1 |
ansible-core-2.20openSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 2.20.11-1.1 | 2.20.11-1.1 |
ansible-core-2.21openSUSE:Tumbleweed From an advisory covering 11 CVEs |
before 2.21.6-1.1 | 2.21.6-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | EUVD, NVD, OSV | |
| products, references, severity, title | CVE List | |
| aliases, references | EUVD | |
| aliases, cwes, description, references, severity, title | GitHub Advisories | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-84503 is a medium vulnerability (CVSS 6.7) in Red Hat Migration Toolkit For Applications 8, published November 6, 2026. No source lists public exploit code. No source names a fixed version.
References
access.redhat.com/security/cve/CVE-2026-84503
bugzilla.redhat.com/show_bug.cgi?id=2527098
nvd.nist.gov/vuln/detail/CVE-2026-84503
github.com/advisories/GHSA-537w-5jw6-89cf
security-tracker.debian.org/tracker/CVE-2026-84503
suse.com/security/cve/CVE-2026-105929
Show 10 moreShow less
Left out here: 5 versions. The JSON record has them.