Quick answers
- Is CVE-2026-84503 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-84503 being exploited in the wild.
- How severe is CVE-2026-84503?
- Medium severity, with a CVSS score of 6.7, published 9 November 2026.
- Which products and versions are affected?
- Red Hat ansible-core.
- Is there a fix for CVE-2026-84503?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-84503 attacked?
- It is attacked with local access.
- Am I affected by CVE-2026-84503?
- Check whether you run Red Hat Ansible-Core. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The ansible.builtin.git module invokes git commands (ls-remote, clone, fetch) with the repository URL as a positional argument without a "--" separator, allowing URLs beginning with a dash to be interpreted as command-line options. An attacker providing a malicious repository URL can inject arguments like --upload-pack or --exec to achieve arbitrary command execution on the control-plane host. This requires low privileges and user interaction (passing the attacker-controlled URL to the module).
Affected products
- Red Hat ansible-core
Timeline
- 2026-11-09: disclosed