CVE-2026-16493 Ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for cve-2026-11332)
Attackers can execute arbitrary commands via crafted git URIs during ansible-galaxy collection installation due to missing argument separators.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-16493?
CVE-2026-16493 is a high-severity command injection vulnerability in Red Hat Ansible Automation Platform 2, published on 21 Jul 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
Weakness: CWE-88
Which versions are affected by CVE-2026-16493?
Linux distribution packages (4)
ansible-core openSUSE:Tumbleweed | All versions | 2.21.4-2.1 |
ansible-core-2.18 openSUSE:Tumbleweed | All versions | 2.18.19-2.1 |
ansible-core-2.19 openSUSE:Tumbleweed | All versions | 2.19.13-2.1 |
ansible-core-2.20 openSUSE:Tumbleweed | All versions | 2.20.9-2.1 |
How do I fix CVE-2026-16493?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-16493 being exploited?
There is no known exploitation of CVE-2026-16493 in the wild and no public exploit code.
Sources
Also known as AZL-93102, DEBIAN-CVE-2026-16493, ECHO-71ba-bfe4-f745, GHSA-m37p-hmh2-w6j2, UBUNTU-CVE-2026-16493, openSUSE-SU-2026:12052-1 and 3 more.