CVE-2026-16493: Red Hat Ansible Automation Platform 2

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.

Affected products

• Red Hat Red Hat Ansible Automation Platform 2
• Red Hat Red Hat Enterprise Linux 10
• Red Hat Red Hat Enterprise Linux 8
• Red Hat Red Hat Enterprise Linux 9
• Red Hat Red Hat Satellite 6.17 For Rhel 9: before 1:2.16.19-1.el9sat (fixed in 1:2.16.19-1.el9sat)
• Red Hat Red Hat Satellite 6.18 For Rhel 9: before 1:2.16.19-1.el9sat (fixed in 1:2.16.19-1.el9sat); before 0:1.3.1-5.el9pc (fixed in 0:1.3.1-5.el9pc); before 0:3.73.30-3.el9pc (fixed in 0:3.73.30-3.el9pc)
• Red Hat Red Hat Satellite 6.19 For Rhel 9: before 1:2.16.19-1.el9sat (fixed in 1:2.16.19-1.el9sat)

Published 2026-07-21. Last modified 2026-09-04.