{"id":"CVE-2026-84503","aliases":["DEBIAN-CVE-2026-84503","EUVD-2026-120161","GHSA-537w-5jw6-89cf","openSUSE-SU-2026:12448-1","openSUSE-SU-2026:12449-1","openSUSE-SU-2026:12450-1","openSUSE-SU-2026:12451-1"],"status":"published","title":"Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -\u003e rce","description":"A flaw was found in ansible-core's ansible.builtin.git module. The module\ninvokes git (ls-remote, clone, fetch) with the repository URL as a positional\nargument and without a \"--\" separator, so a repository URL that begins with a\ndash is interpreted by git as a command-line option. A caller that passes an\nattacker-controlled repository URL to the module can trigger argument\ninjection (for example --upload-pack/--exec), resulting in arbitrary command\nexecution on the host running the module.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-88"],"published":"2026-11-06T00:00:00Z","modified":"2026-11-09T21:00:07Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.14.10-1","2.14.11-1","2.14.11-2","2.14.13-1","2.14.16-0+deb12u1","2.14.18-0+deb12u1","2.14.18-0+deb12u2","2.14.3-1","2.14.6-1","2.14.7-1","2.14.8-1","2.14.9-1","2.14.9-2","2.16.5-1","2.16.6-1","2.17.0-1","2.17.1-1","2.17.2-1","2.17.3-1","2.17.5-1","2.17.5-2","2.17.5-3","2.17.5-4","2.17.5-5","2.18.0-1","2.18.0-2","2.18.1-1","2.18.1-2","2.18.1-3","2.18.1-4","2.18.3-1","2.19.0-1","2.19.0~beta1-1","2.19.0~beta1-2","2.19.0~beta2-1","2.19.0~beta4-1","2.19.0~beta5-1","2.19.0~beta6-1","2.19.0~rc2-1","2.19.1-1","2.19.2-1","2.19.3-1","2.19.3-2","2.19.4-1","2.19~pre20250506~462affa7c4-1","2.19~pre20250510~5347d4d4fc-1","2.20.1-1","2.20.3-1","2.21.0-1","2.21.1~rc1-1","2.21.1~rc1-2","2.21.2-1","2.22.0-1","2.22.0~beta1-1","2.22.0~beta2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-1","2.19.0~beta6-1","2.19.0~rc2-1","2.19.1-0+deb13u1","2.19.1-1","2.19.11-0+deb13u1","2.19.2-1","2.19.3-1","2.19.3-2","2.19.4-0+deb13u1","2.19.4-1","2.20.1-1","2.20.3-1","2.21.0-1","2.21.1~rc1-1","2.21.1~rc1-2","2.21.2-1","2.22.0-1","2.22.0~beta1-1","2.22.0~beta2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-1","2.19.0~beta6-1","2.19.0~rc2-1","2.19.1-1","2.19.2-1","2.19.3-1","2.19.3-2","2.19.4-1","2.20.1-1","2.20.3-1","2.21.0-1","2.21.1~rc1-1","2.21.1~rc1-2","2.21.2-1","2.22.0-1","2.22.0~beta1-1","2.22.0~beta2-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ansible-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.6-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ansible-core-2.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.15-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ansible-core-2.20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.11-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ansible-core-2.21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.21.6-1.1"}]}],"bundled":11}],"products":[{"vendor":"red hat","product":"migration toolkit for applications 8"},{"vendor":"red hat","product":"migration toolkit for virtualization"},{"vendor":"red hat","product":"openshift service mesh 3"},{"vendor":"red hat","product":"red hat advanced cluster management for kubernetes 2"},{"vendor":"red hat","product":"red hat ansible automation platform 2"},{"vendor":"red hat","product":"red hat ansible automation platform ansible core 2"},{"vendor":"red hat","product":"red hat certification program for red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat discovery 2"},{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift container platform 5"},{"vendor":"red hat","product":"red hat openstack platform 17.1"},{"vendor":"red hat","product":"red hat openstack platform 18.0"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat update infrastructure 5"},{"vendor":"red hat","product":"self-service automation portal 2"},{"vendor":"red hat","product":"service telemetry framework 1.5"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-84503","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2527098","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84503"},{"url":"https://github.com/advisories/GHSA-537w-5jw6-89cf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-84503","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-105929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-84503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-11079","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-9902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-11332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-89091","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-84503","title":"Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -\u003e rce","description":"A flaw was found in ansible-core's ansible.builtin.git module. The module\ninvokes git (ls-remote, clone, fetch) with the repository URL as a positional\nargument and without a \"--\" separator, so a repository URL that begins with a\ndash is interpreted by git as a command-line option. A caller that passes an\nattacker-controlled repository URL to the module can trigger argument\ninjection (for example --upload-pack/--exec), resulting in arbitrary command\nexecution on the host running the module.","status":"published","published":"2026-11-09T17:57:01.391Z","modified":"2026-11-09T17:57:01.391Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-88"],"updated_at":"2026-11-09T19:34:29.555364Z"}],"euvd":[{"id":"EUVD-2026-120161","description":"A flaw was found in ansible-core's ansible.builtin.git module. The module\ninvokes git (ls-remote, clone, fetch) with the repository URL as a positional\nargument and without a \"--\" separator, so a repository URL that begins with a\ndash is interpreted by git as a command-line option. A caller that passes an\nattacker-controlled repository URL to the module can trigger argument\ninjection (for example --upload-pack/--exec), resulting in arbitrary command\nexecution on the host running the module.","status":"published","published":"2026-11-09T17:57:01Z","modified":"2026-11-09T17:57:01Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-09T20:18:00.775342Z"}],"ghsa":[{"id":"GHSA-537w-5jw6-89cf","title":"A flaw was found in ansible-core's ansible.builtin.git module. The module\ninvokes git (ls-remote,...","description":"A flaw was found in ansible-core's ansible.builtin.git module. The module\ninvokes git (ls-remote, clone, fetch) with the repository URL as a positional\nargument and without a \"--\" separator, so a repository URL that begins with a\ndash is interpreted by git as a command-line option. A caller that passes an\nattacker-controlled repository URL to the module can trigger argument\ninjection (for example --upload-pack/--exec), resulting in arbitrary command\nexecution on the host running the module.","status":"published","published":"2026-11-09T18:32:02Z","modified":"2026-11-09T18:32:07Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-88"],"updated_at":"2026-11-09T18:49:20.8938Z"}],"nvd":[{"id":"CVE-2026-84503","description":"A flaw was found in ansible-core's ansible.builtin.git module. The module\ninvokes git (ls-remote, clone, fetch) with the repository URL as a positional\nargument and without a \"--\" separator, so a repository URL that begins with a\ndash is interpreted by git as a command-line option. A caller that passes an\nattacker-controlled repository URL to the module can trigger argument\ninjection (for example --upload-pack/--exec), resulting in arbitrary command\nexecution on the host running the module.","status":"published","published":"2026-11-09T18:17:34.233Z","modified":"2026-11-09T18:17:34.377Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-88"],"updated_at":"2026-11-09T20:15:34.896267Z"}],"osv":[{"id":"DEBIAN-CVE-2026-84503","description":"A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a \"--\" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.","status":"published","published":"2026-11-09T18:17:34.233Z","modified":"2026-11-10T05:00:07.916877422Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-10T05:22:46.487299Z"},{"id":"openSUSE-SU-2026:12448-1","title":"ansible-core-2.21.6-1.1 on GA media","description":"These are all security issues fixed in the ansible-core-2.21.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:14.825776224Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"openSUSE-SU-2026:12449-1","title":"ansible-core-2.19-2.19.15-1.1 on GA media","description":"These are all security issues fixed in the ansible-core-2.19-2.19.15-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:14.882900762Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"openSUSE-SU-2026:12450-1","title":"ansible-core-2.20-2.20.11-1.1 on GA media","description":"These are all security issues fixed in the ansible-core-2.20-2.20.11-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:14.880268287Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"openSUSE-SU-2026:12451-1","title":"ansible-core-2.21-2.21.6-1.1 on GA media","description":"These are all security issues fixed in the ansible-core-2.21-2.21.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:14.884276446Z","updated_at":"2026-11-07T17:50:39.727056Z"}]}}