CVE-2026-71465
Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable
3.1 LowFix available
RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
0.21%Unchanged since Sep 24, 2026
What each source reports
CVE List Score used
Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable
RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern.
- Record
CVE-2026-71465- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-88
- Updated
- 2026-11-02
EUVDEUVD-2026-85542
RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern.
- Record
EUVD-2026-85542- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j69q-g7fm-7qpm
RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit))...
RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern.
- Record
GHSA-j69q-g7fm-7qpm- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-88
- Updated
- 2026-11-02
NVD
RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern.
- Record
CVE-2026-71465- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-88
- Updated
- 2026-11-02
OSVRHSA-2026:71113
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
- Record
RHSA-2026:71113- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2026:71114
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Record
RHSA-2026:71114- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.6::el9 |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el10 |
before 0:1.6.8-1.el10ap | 0:1.6.8-1.el10ap |
receptorRed Hat:ansible_automation_platform_developer:2.6::el9 |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.6::el9 |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.6::el9 |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.6::el9 |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el10 |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python-sqlparseRed Hat:ansible_automation_platform:2.6::el10 |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
python3-sqlparseRed Hat:ansible_automation_platform:2.6::el10 |
before 0:0.6.0-1.el10ap | 0:0.6.0-1.el10ap |
Show 28 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.6::el9 |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.6::el9 |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-platform-uiRed Hat:ansible_automation_platform:2.6::el9 |
before 0:2.6.14-1.el9ap | 0:2.6.14-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform_developer:2.6::el9 |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform_developer:2.6::el9 |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controllerRed Hat:ansible_automation_platform:2.6::el9 |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-cliRed Hat:ansible_automation_platform:2.6::el9 |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-serverRed Hat:ansible_automation_platform:2.6::el9 |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
automation-controller-uiRed Hat:ansible_automation_platform:2.6::el9 |
before 0:4.7.17-1.el9ap | 0:4.7.17-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.6::el9 |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el8 |
before 0:4.6.33-1.el8ap | 0:4.6.33-1.el8ap |
automation-controller-venv-towerRed Hat:ansible_automation_platform:2.5::el9 |
before 0:4.6.33-1.el9ap | 0:4.6.33-1.el9ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el8 |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el8 |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el8 |
before 0:2.5.10-8.el8ap | 0:2.5.10-8.el8ap |
receptorRed Hat:ansible_automation_platform:2.5::el8 |
before 0:1.6.8-1.el8ap | 0:1.6.8-1.el8ap |
receptorRed Hat:ansible_automation_platform_developer:2.5::el9 |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
receptorRed Hat:ansible_automation_platform_inside:2.5::el9 |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
automation-gateway-proxy-serverRed Hat:ansible_automation_platform:2.5::el9 |
before 0:2.6.17-3.el9ap | 0:2.6.17-3.el9ap |
receptorRed Hat:ansible_automation_platform:2.5::el9 |
before 0:1.6.8-1.el9ap | 0:1.6.8-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.5::el8 |
before 0:0.6.0-1.el8ap | 0:0.6.0-1.el8ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.5::el8 |
before 0:0.6.0-1.el8ap | 0:0.6.0-1.el8ap |
python3.12-sqlparseRed Hat:ansible_automation_platform_developer:2.5::el9 |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
python3.12-sqlparseRed Hat:ansible_automation_platform:2.5::el9 |
before 0:0.6.0-1.el9ap | 0:0.6.0-1.el9ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el8 |
before 0:2.5.20260923-1.el8ap | 0:2.5.20260923-1.el8ap |
automation-gateway-serverRed Hat:ansible_automation_platform:2.5::el9 |
before 0:2.5.20260923-1.el9ap | 0:2.5.20260923-1.el9ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el8 |
before 0:3.1.60-1.el8ap | 0:3.1.60-1.el8ap |
python3.12-gitpythonRed Hat:ansible_automation_platform:2.5::el9 |
before 0:3.1.60-1.el9ap | 0:3.1.60-1.el9ap |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-71465 is a low vulnerability (CVSS 3.1) in Red Hat Ansible Automation Platform 2.5 For Rhel 8, published September 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in automation-controller-venv-tower 0:4.7.17-1.el9ap.
References
access.redhat.com/errata/RHSA-2026:71113
bugzilla.redhat.com/show_bug.cgi?id=2512375
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-71465
github.com/advisories/GHSA-j69q-g7fm-7qpm
docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_71113.json
cve.org/CVERecord?id=CVE-2026-12564
go.dev/cl/814980
groups.google.com/g/golang-announce/c/94pEornpRlI
pkg.go.dev/vuln/GO-2026-5972
vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
This page doesn't list everything
Left out here: 136 references. The JSON record has them.