redhat/openstack-ansible-core vulnerabilities

Latest redhat/openstack-ansible-core CVEs

Newest publication first

1. CVE-2026-84503 Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce

   Published 2026-11-09

   Medium·CVSS 6.7 EPSS 0.19%

   A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line optio...

2. CVE-2026-89091 Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

   Published 2026-10-08

   High·CVSS 8.8 EPSS 0.48%

   A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no contai...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.