{"id":"CVE-2026-71465","state":"PUBLISHED","title":"Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable","description":"RunAdHocCommand.build_args() appends limit as bare\n              positional (args.append(limit)) instead of using\n              args.extend(['-l', limit]) like RunJob. A limit beginning\n              with - is parsed as an ansible CLI option. Currently\n              limited to short-circuit flags (--version, --help) since\n              injected element displaces required pattern positional.\n              Would escalate if ansible-core ever defaults pattern.","publishedAt":"2026-09-23T18:29:05.279Z","updatedAt":"2026-10-16T12:01:25.153Z","severity":{"score":3.1,"label":"Low","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8","Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9","Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9","Red Hat Red Hat Ansible Automation Platform 2.6","Red Hat Red Hat Ansible Automation Platform 2.7"],"affected":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.6.33-1.el8ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.6.33-1.el9ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.7.17-1.el9ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","packageName":"ansible-automation-platform-26/controller-rhel9","defaultStatus":"affected","versions":[{"version":"1789673739","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","packageName":"ansible-automation-platform-27/controller-rhel9","defaultStatus":"affected","versions":[{"version":"1789580684","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"]}],"references":["https://access.redhat.com/errata/RHSA-2026:71113","https://access.redhat.com/errata/RHSA-2026:71114","https://access.redhat.com/errata/RHSA-2026:71177","https://access.redhat.com/errata/RHSA-2026:71179","https://access.redhat.com/security/cve/CVE-2026-71465","https://bugzilla.redhat.com/show_bug.cgi?id=2512375"],"weaknesses":["CWE-88"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/71xxx/CVE-2026-71465.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-71465","state":"PUBLISHED","datePublished":"2026-09-23T18:29:05.279Z","dateUpdated":"2026-10-16T12:01:25.153Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2026-08-06T19:31:51.453Z"},"containers":{"cna":{"title":"Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable","descriptions":[{"lang":"en","value":"RunAdHocCommand.build_args() appends limit as bare\n              positional (args.append(limit)) instead of using\n              args.extend(['-l', limit]) like RunJob. A limit beginning\n              with - is parsed as an ansible CLI option. Currently\n              limited to short-circuit flags (--version, --help) since\n              injected element displaces required pattern positional.\n              Would escalate if ansible-core ever defaults pattern."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 8","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.6.33-1.el8ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.5 for RHEL 9","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.6.33-1.el9ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.5::el8","cpe:/a:redhat:ansible_automation_platform:2.5::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8","cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8","cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6 for RHEL 9","packageName":"automation-controller","defaultStatus":"affected","versions":[{"version":"0:4.7.17-1.el9ap","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el10","cpe:/a:redhat:ansible_automation_platform:2.6::el9","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el10","cpe:/a:redhat:ansible_automation_platform_developer:2.6::el9","cpe:/a:redhat:ansible_automation_platform_inside:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.6","packageName":"ansible-automation-platform-26/controller-rhel9","defaultStatus":"affected","versions":[{"version":"1789673739","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.6::el9"]},{"vendor":"Red Hat","product":"Red Hat Ansible Automation Platform 2.7","packageName":"ansible-automation-platform-27/controller-rhel9","defaultStatus":"affected","versions":[{"version":"1789580684","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:ansible_automation_platform:2.7::el9"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","name":"RHSA-2026:71113","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","name":"RHSA-2026:71114","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","name":"RHSA-2026:71177","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","name":"RHSA-2026:71179","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71465","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512375","name":"RHBZ#2512375","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":3.1,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-88","description":"Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-10-16T12:01:25.153Z"},"datePublic":"2026-09-06T00:00:00.000Z","x_redhatCweChain":"CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')","workarounds":[{"lang":"en","value":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}],"timeline":[{"lang":"en","time":"2026-08-06T23:29:24.872Z","value":"Reported to Red Hat."},{"lang":"en","time":"2026-09-06T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"This issue was discovered by Chris Meyers (Red Hat)."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-23T19:04:48.678853Z","id":"CVE-2026-71465","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-09-23T19:41:55.448Z"}}]}}}