ansible-core git module: repository URL starting with a dash is parsed as a git option, enabling command execution

Impact

The ansible.builtin.git module passes the repository URL to git ls-remote, clone and fetch without a "--" separator. A URL that begins with a dash is therefore read as a git option such as --upload-pack, which runs arbitrary commands on the host executing the module. This only matters where an attacker can influence the repo URL a playbook passes in, for example through templated variables or self-service job templates. The scoring reflects that (local vector, high complexity, user interaction required). Where it applies, the attacker gets command execution on the hosts Ansible provisions or on the controller, with the privileges of the task.

Who can reach it

A user who can control the repository URL given to ansible.builtin.git, for example through playbook variables or inventory data. Low privileges are needed, and a playbook run has to pick up the value.

What to do

Apply the ansible-core update from Red Hat or upstream once it is available for your release. The record does not name a fixed version. Until then, validate or hard-code repository URLs in playbooks and do not pass untrusted input to the git module's repo parameter.

References

Related entries

• GlusterFS (glusterd management): An authenticated TLS client can use gluster cli --remote-host to add itself to theCVE-2018-10841 · GlusterFS (glusterd management)Medium
• Intel SPS (HECI subsystem compartmentalisation): Insufficient compartmentalisation in the HECI interfaceCVE-2021-0060 · Intel SPS (HECI subsystem compartmentalisation)Medium
• Dell CloudLink (cluster component exception handling): A highly privileged remote attacker performs unauthorizedCVE-2024-38482 · Dell CloudLink (cluster component exception handling)Medium
• Ansible Automation Controller: improper authorization lets a mounted service account token escalate privilegesCVE-2024-6840 · Ansible Automation Controller (Kubernetes service account token authorization)Medium
• AMD Versal Adaptive SoC - PLM runtime services address validation: The Platform Loader and Manager firmware on AMDCVE-2025-0037 · AMD Versal Adaptive SoC - PLM runtime services address validationMedium
• Ansible automation-controller: unvalidated system-job "days" value injects arguments into control-node awx-manageCVE-2026-84724 · Red Hat Ansible Automation Platform automation-controller (system-job launch, awx-manage argument vector)Medium