PatchSiren cyber security CVE debrief
CVE-2026-16493 Red Hat CVE debrief
CVE-2026-16493 is a HIGH severity vulnerability in ansible-core. The _extract_collection_from_git() function constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332. The vulnerability allows for arbitrary command execution, and users should prioritize patching or mitigating it.
- Vendor
- Red Hat
- Product
- Red Hat Ansible Automation Platform 2
- CVSS
- HIGH 7.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-21
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-21
- Advisory updated
- 2026-07-22
Who should care
Users of ansible-core who install collections from git sources should be aware of this vulnerability and take steps to mitigate it. Affected operators, platform administrators, vulnerability management teams, and security teams should prioritize patching or mitigating this vulnerability.
Technical summary
The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. This allows an attacker to inject git arguments and achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. The vulnerability is an incomplete fix for CVE-2026-11332 and affects users who install collections from git sources.
Defensive priority
High priority should be given to patching or mitigating this vulnerability, as it allows for arbitrary command execution.
Recommended defensive actions
- Apply the patch for CVE-2026-16493
- Use a trusted source for collection installation
- Validate user-supplied URLs before using them in git clone commands
- Monitor for suspicious activity related to ansible-galaxy collection install
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-21T18:16:57.030Z and was last modified on 2026-07-22T15:16:53.960Z. The NVD entry is currently Awaiting Analysis. Evidence is limited, and defenders should verify affected scope and vendor guidance.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-21T18:16:57.030Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.