CVE-2026-71465 Command injection in Red Hat Ansible Automation Platform 2.5 for RHEL 8
Attackers can inject CLI arguments into the ansible executable via the ad-hoc command limit field, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-71465?
CVE-2026-71465 is a low-severity command injection vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 23 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern.
Weakness: CWE-88
Which versions are affected by CVE-2026-71465?
How do I fix CVE-2026-71465?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-71465 being exploited?
There is no known exploitation of CVE-2026-71465 in the wild and no public exploit code.
Sources
Also known as GHSA-j69q-g7fm-7qpm.