Bug 2503724 (CVE-2026-16493)

Summary: CVE-2026-16493 ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anthomas, dschmidt, ehelms, ggainey, jlanda, jpasqual, juwatts, kshier, mhulan, nmoumoul, osousa, pcreech, rchan, rhel-process-autobot, simaishi, smallamp, stcannon, teagle, tmalecek, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2503754, 2503755    
Bug Blocks:    

Description OSIDB Bzimport 2026-07-21 16:35:08 UTC 
An argument injection vulnerability was found in ansible-core's collection install functionality. The _extract_collection_from_git() function in lib/ansible/galaxy/collection/concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied values. This allows an attacker to craft a malicious collection source URI (e.g. 'git+-ccore.sshCommand=sh -c "malicious_command"') that, when processed by 'ansible-galaxy collection install', causes git to interpret attacker-controlled input as command-line flags rather than positional arguments. Through the -ccore.sshCommand technique, this achieves arbitrary command execution without requiring any special git transport configuration.

This is an incomplete fix for CVE-2026-11332 (BZ#2485379, GHSA-w8p5-mx5w-cpqj). The CVE-2026-11332 fix added a '--' end-of-options separator to the ROLE install path in lib/ansible/utils/galaxy.py, but the analogous COLLECTION install path in lib/ansible/galaxy/collection/concrete_artifact_manager.py was not hardened. The collection install path uses the same pattern of passing user-controlled git URLs directly to subprocess.check_call() without the '--' guard.

Source code verification confirmed the vulnerability is present on all active branches (devel, stable-2.18, stable-2.17) as of 2026-07-21. The parse_scm() function performs no security-relevant URL validation — no scheme check, no argument prefix check, no sanitization.

Additionally, the git checkout command in the same function also lacks '--' before the user-supplied version value, providing a secondary injection point.