CVE-2026-71465: Automation-controller: automation-controller-container: automation-controller: ad-hoc command limit field allows cli argument injection into ansible executable
A flaw was found in automation-controller. RunAdHocCommand.buildargs() appends the limit field as a bare positional argument instead of using the -l flag prefix as RunJob does. An attacker can set the limit field to a value beginning with a dash, which is then parsed as an ansible CLI option. The impact is currently limited to short-circuit flags such as --version and --help because the injected element displaces the required pattern positional argument.
Other sources
RunAdHocCommand.buildargs() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since injected element displaces required pattern positional. Would escalate if ansible-core ever defaults pattern.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Update RunAdHocCommand.build_args() to append the limit using args.extend(['-l', limit]) instead of appending the limit as a bare positional argument.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges to set the ad-hoc command limit field. The supplied data does not indicate that unauthenticated users can reach the vulnerable code path.
What input triggers the argument injection?
The limit field must begin with a dash so that it is interpreted as an ansible CLI option rather than a limit value. The affected argument construction passes this field as a bare positional argument.
What is the currently known impact?
The known impact is limited to short-circuit ansible options such as --version and --help, resulting in integrity impact. The injected argument displaces the required pattern positional argument, preventing broader option injection under current behavior.
Could the impact change over time?
Yes. The issue could escalate if ansible-core changes to provide a default pattern, because the displaced required pattern argument would no longer constrain injected CLI options.