CVE-2026-84503 · Infrastructure
NO FIX YET
The ansible.builtin.git module passes the repository URL to git without a "--" separator, so a URL starting with a dash is read as a git option. An attacker who controls the URL can use options such as --upload-pack to run arbitrary commands on the host running the module.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams whose automation runs ansible.builtin.git with a repository URL that an outside party or untrusted input can influence, such as self-service portals, pipelines that take URLs from requests, or variables filled from external sources. Playbooks that use only fixed, trusted repository URLs are unlikely to be exposed. The sources do not name affected ansible-core versions.
Not affected if fixed-repo-urls, no-user-controlled-input
Who cares ansible, ansible-core, automation, ci-cd
ansible --version.ansible.builtin.git or git: tasks whose repo value comes from user input, variables, or external data.No fix yet, per the sources.
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
This page as .md · .json · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.