MEDIUM 6.7 NVD
CVE-2026-84503
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument
A flaw was found in ansible-core's ansible.builtin.git module. The module
invokes git (ls-remote, clone, fetch) with the repository URL as a positional
argument and without a "--" separator, so a repository URL that begins with a
dash is interpreted by git as a command-line option. A caller that passes an
attacker-controlled repository URL to the module can trigger argument
injection (for example --upload-pack/--exec), resulting in arbitrary command
execution on the host running the module.
References
- https://access.redhat.com/security/cve/CVE-2026-84503
- https://bugzilla.redhat.com/show_bug.cgi?id=2527098
This medium severity vulnerability with a CVSS score of 6.7 was published on 2026-11-09 via NVD.
vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.