cyfenced.com →

[ CVE-2026-71465 · Published 23 Sep 2026 ]

Vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8

CVSS 3.1 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

[ References ]References