attack vector is local; attack complexity is low; privileges required is none; user interaction is required; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
see table below
Classified as
CWE-88 (Improper Neutralization of Argument Delimiters in a Command ('Argument Injection'))
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Ansible Automation Platform 2
Red Hat
Red Hat Satellite 6.17 for RHEL 9
Red Hat
Red Hat Satellite 6.18 for RHEL 9
Red Hat
Red Hat Satellite 6.19 for RHEL 9
Subsystems
OT Supporting Infrastructure
Sectors
Multiple
What to Know
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases.