Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-84503

Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce

A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Ansible Automation Platform Ansible Core and 15 more
CVE-2026-123037

Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)

A flaw was found in the ansible-core user module. When generate_ssh_key is enabled, User.ssh_key_gen() guards the key files against symlinks but checks the ~/.ssh directory only with os.path.exists(). An unprivileged user on a managed node who replaces their ~/.ssh with a symlink to an existing root-writable directory causes the privileged module to write the generated key pair through the symlink and then chown both files to that user. Because such files can be dropped into directories processed by schedulers (e.g. /etc/cron.daily) or dynamic MOTD (/etc/update-motd.d), the user can escalate to root on the managed node. This is an incomplete fix of CVE-2024-9902.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Ansible Automation Platform Ansible Core and 9 more
CVE-2026-89091

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Ansible Automation Platform Ansible Core and 11 more
CVE-2026-11332

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Acm Ansible Automation Platform Ansible Automation Platform Developer and 17 more