Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.1
CVE-2026-71465: Red Hat Ansible Automation Platform command injection via limit
CVE-2026-71465 · published 1 month ago
Summary
The Automation Controller component of Red Hat Ansible Automation Platform can treat a specially crafted "limit" value as if it were a command-line option for the underlying Ansible tool. This could let an attacker run unintended Ansible commands on the system. Apply the latest security update from Red Hat or restrict the input to the limit field to trusted values.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| red hat | red hat ansible automation platform 2 | All versions |
| red hat | red hat ansible automation platform 2.5 for rhel 8 | All versions |
| red hat | red hat ansible automation platform 2.5 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2.6 for rhel 9 | All versions |
| red hat | red hat ansible automation platform 2.6 | All versions |
| red hat | red hat ansible automation platform 2.7 | All versions |
Original advisory text
Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable
RunAdHocCommand.build_args() appends limit as bare
positional (args.append(limit)) instead of using
args.extend(['-l', limit]) like RunJob. A limit beginning
with - is parsed as an ansible CLI option. Currently
limited to short-circuit flags (--version, --help) since
injected element displaces required pattern positional.
Would escalate if ansible-core ever defaults pattern.
positional (args.append(limit)) instead of using
args.extend(['-l', limit]) like RunJob. A limit beginning
with - is parsed as an ansible CLI option. Currently
limited to short-circuit flags (--version, --help) since
injected element displaces required pattern positional.
Would escalate if ansible-core ever defaults pattern.
References
- https://access.redhat.com/security/cve/CVE-2026-71465 vdb-entry x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:71113 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:71114 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:71177 vendor-advisory x_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:71179 vendor-advisory x_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2512375 issue-tracking x_refsource_REDHAT
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published23 Sep 2026
Updated29 Oct 2026
First seen23 Sep 2026
Track software like this
Free during beta