VDB

CVE-2026-71465

CVE-2026-71465 PUBLISHED CVSS 3.1 LOW

Reported by redhat · Published September 23, 2026

RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern.

Risk Scores

CVSS 3.1
3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected Products

VendorProductVersions
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.61789673739
Red HatRed Hat Ansible Automation Platform 2.71789580684
Red HatRed Hat Ansible Automation Platform 2.71789580684
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2.61789673739
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 90:4.6.33-1.el9ap
Red HatRed Hat Ansible Automation Platform 2.6 for RHEL 90:4.7.17-1.el9ap
Red HatRed Hat Ansible Automation Platform 2
Red HatRed Hat Ansible Automation Platform 2.5 for RHEL 80:4.6.33-1.el8ap

Timeline

  • Sep 23, 2026 Coalition ESS Score
  • Sep 23, 2026 CVE Published
  • Sep 24, 2026 EPSS Score
  • Sep 24, 2026 Distribution Patch
  • Sep 24, 2026 Security Advisory
  • Sep 26, 2026 EPSS Score
  • Oct 6, 2026 EPSS Score
  • Oct 11, 2026 EPSS Score
  • Oct 14, 2026 EPSS Score
  • Oct 16, 2026 CVE Updated
  • Oct 17, 2026 Distribution Patch
  • Oct 17, 2026 Distribution Patch

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›