{"id":"CVE-2026-84503","kind":"vulnerability","aliases":["CVE-2026-84503"],"related":[],"title":"Ansible git module lets a dash-prefixed repository URL run commands","description":"A flaw was found in ansible-core's ansible.builtin.git module. The module\ninvokes git (ls-remote, clone, fetch) with the repository URL as a positional\nargument and without a \"--\" separator, so a repository URL that begins with a\ndash is interpreted by git as a command-line option. A caller that passes an\nattacker-controlled repository URL to the module can trigger argument\ninjection (for example --upload-pack/--exec), resulting in arbitrary command\nexecution on the host running the module.","summary":"The ansible.builtin.git module passes the repository URL to git without a \"--\" separator, so a URL starting with a dash is read as a git option. An attacker who controls the URL can use options such as --upload-pack to run arbitrary commands on the host running the module.","severity":"medium","cvss":6.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ansible","ansible-core","automation","ci-cd","infrastructure"],"not_affected_if":["fixed-repo-urls","no-user-controlled-input"],"how_to_check":"- Check the installed ansible-core version with `ansible --version`.\n- Search playbooks and roles for `ansible.builtin.git` or `git:` tasks whose repo value comes from user input, variables, or external data.","fix":null,"status":"open","published_at":"2026-11-09T18:17:34+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","triaged_at":"2026-11-09T18:29:19+00:00","updated_at":"2026-11-09T18:29:19+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-09T18:29:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Ansible git module lets a dash-prefixed repository URL run commands","impact":"high","summary":"The ansible.builtin.git module passes the repository URL to git without a \"--\" separator, so a URL starting with a dash is read as a git option. An attacker who controls the URL can use options such as --upload-pack to run arbitrary commands on the host running the module.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["ansible","ansible-core","automation","ci-cd"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Arbitrary command execution on the host running the git module.","analyst_note":"Confirm affected and fixed ansible-core versions and whether a patch exists, from the NVD entry or the Ansible project advisory.","how_to_check":"- Check the installed ansible-core version with `ansible --version`.\n- Search playbooks and roles for `ansible.builtin.git` or `git:` tasks whose repo value comes from user input, variables, or external data.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-repo-urls","no-user-controlled-input"],"who_is_affected":"Teams whose automation runs ansible.builtin.git with a repository URL that an outside party or untrusted input can influence, such as self-service portals, pipelines that take URLs from requests, or variables filled from external sources. Playbooks that use only fixed, trusted repository URLs are unlikely to be exposed. The sources do not name affected ansible-core versions.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000755,"input_tokens":4599,"output_tokens":590,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-84503':15A,18A 'ansibl':1A,19B,21B,83C 'ansible-cor':20B,82C 'ansible.builtin.git':29B,86C 'arbitrari':69B,153C 'argument':104C,143C 'attack':54B,134C 'attacker-control':133C 'autom':23B 'begin':114C 'caller':129C 'cd':26B 'ci':25B 'ci-cd':24B 'clone':95C 'command':12A,70B,125C,154C 'command-lin':124C 'control':56B,135C 'core':22B,84C 'cve':13A,16A 'dash':7A,46B,117C 'dash-prefix':6A 'exampl':146C 'exec':150C 'execut':155C 'fetch':96C 'flaw':78C 'found':80C 'git':2A,36B,51B,91C,121C 'host':73B,158C 'infrastructur':27B 'inject':144C 'interpret':119C 'invok':90C 'let':4A 'line':126C 'ls':93C 'ls-remot':92C 'modul':3A,30B,76B,87C,89C,140C,161C 'option':52B,61B,127C 'pack':66B,149C 'pass':31B,131C 'posit':103C 'prefix':8A 'read':48B 'remot':94C 'repositori':9A,33B,99C,111C,136C 'result':151C 'run':11A,68B,74B,159C 'separ':39B,108C 'start':43B 'trigger':142C 'upload':65B,148C 'upload-pack':64B,147C 'url':10A,34B,42B,58B,100C,112C,137C 'use':60B 'without':37B,106C","nicknames":[],"mitigations":[],"who_affected":"Teams whose automation runs ansible.builtin.git with a repository URL that an outside party or untrusted input can influence, such as self-service portals, pipelines that take URLs from requests, or variables filled from external sources. Playbooks that use only fixed, trusted repository URLs are unlikely to be exposed. The sources do not name affected ansible-core versions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ansible","ansiblecore","automation","cicd","infrastructure","medium"],"campaign_type":null,"search_a":"'-2026':14A,17A '-84503':15A,18A 'ansibl':1A 'command':12A 'cve':13A,16A 'dash':7A 'dash-prefix':6A 'git':2A 'let':4A 'modul':3A 'prefix':8A 'repositori':9A 'run':11A 'url':10A","search_b":"'ansibl':19B,21B 'ansible-cor':20B 'ansible.builtin.git':29B 'arbitrari':69B 'attack':54B 'autom':23B 'cd':26B 'ci':25B 'ci-cd':24B 'command':70B 'control':56B 'core':22B 'dash':46B 'git':36B,51B 'host':73B 'infrastructur':27B 'modul':30B,76B 'option':52B,61B 'pack':66B 'pass':31B 'read':48B 'repositori':33B 'run':68B,74B 'separ':39B 'start':43B 'upload':65B 'upload-pack':64B 'url':34B,42B,58B 'use':60B 'without':37B","search_c":"'ansibl':83C 'ansible-cor':82C 'ansible.builtin.git':86C 'arbitrari':153C 'argument':104C,143C 'attack':134C 'attacker-control':133C 'begin':114C 'caller':129C 'clone':95C 'command':125C,154C 'command-lin':124C 'control':135C 'core':84C 'dash':117C 'exampl':146C 'exec':150C 'execut':155C 'fetch':96C 'flaw':78C 'found':80C 'git':91C,121C 'host':158C 'inject':144C 'interpret':119C 'invok':90C 'line':126C 'ls':93C 'ls-remot':92C 'modul':87C,89C,140C,161C 'option':127C 'pack':149C 'pass':131C 'posit':103C 'remot':94C 'repositori':99C,111C,136C 'result':151C 'run':159C 'separ':108C 'trigger':142C 'upload':148C 'upload-pack':147C 'url':100C,112C,137C 'without':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T18:17:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-84503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84503","severity":null,"published_at":"2026-11-09T18:17:34+00:00","modified_at":"2026-11-09T18:17:34+00:00","first_seen_at":"2026-11-09T18:27:56+00:00","fetched_at":"2026-11-09T18:27:56+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}