An argument injection vulnerability was found in ansible-core's collection install functionality. The extractcollectionfromgit() function in lib/ansible/galaxy/collection/concreteartifactmanager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied values. This allows an attacker to craft a malicious collection source URI (e.g. 'git+-ccore.sshCommand=sh -c "maliciouscommand"') that, when processed by 'ansible-galaxy collection install', causes git to interpret attacker-controlled input as command-line flags rather than positional arguments. Through the -ccore.sshCommand technique, this achieves arbitrary command execution without requiring any special git transport configuration.
This is an incomplete fix for CVE-2026-11332 (BZ#2485379, GHSA-w8p5-mx5w-cpqj). The CVE-2026-11332 fix added a '--' end-of-options separator to the ROLE install path in lib/ansible/utils/galaxy.py, but the analogous COLLECTION install path in lib/ansible/galaxy/collection/concreteartifactmanager.py was not hardened. The collection install path uses the same pattern of passing user-controlled git URLs directly to subprocess.checkcall() without the '--' guard.
Source code verification confirmed the vulnerability is present on all active branches (devel, stable-2.18, stable-2.17) as of 2026-07-21. The parsescm() function performs no security-relevant URL validation — no scheme check, no argument prefix check, no sanitization.
Additionally, the git checkout command in the same function also lacks '--' before the user-supplied version value, providing a secondary injection point.
community.general's ipagetkeytab module (plugins/modules/ipagetkeytab.py) declares its bindpw argument WITHOUT nolog:
binddn=dict(type="str"), bindpw=dict(type="str"), # missing nolog password=dict(type="str", nolog=True), # sibling has it
Because the value is neither flagged with nolog nor caught by ansible-core's name-based redaction heuristic, the IPA simple-bind password is disclosed through several channels.
Exposure vectors ---------------- 1. Log disclosure (CWE-532): the value appears in cleartext in the target host's journal/syslog "Invoked with" line, in the module's return values / -v output, and in Automation Controller / AWX job output. 2. Process-list disclosure (CWE-214): the module passes the password to the child helper as ipa-getkeytab ... --bindpw <cleartext> ... (bindpw=cmdrunnerfmt.asoptval("--bindpw")), so it is visible in ps / /proc/<pid>/cmdline to local users during execution. This vector is the child process's own argv and is NOT remediated by nolog. 3. Contributing cleartext storage (CWE-312).
Why automatic redaction does not apply -------------------------------------- ansible-core's name-based safety net is PASSWORDMATCH in lib/ansible/moduleutils/basic.py (not parameters.py). Its regex requires a literal "pass" substring:
^(?:.+[-\s])?pass(?:[-\s]?(?:word|phrase|wrd|wd)?)(?:[-\s].+)?$
"bindpw" / "bindpw" contain no "pass" substring, so the pattern does not match: no warning and no auto-redaction. Even when PASSWORDMATCH does match a name, it only substitutes 'NOTLOGGINGPASSWORD' in the "Invoked with" line and emits a warning — it does not add the value to nologvalues, so return values and other logging remain unredacted. Explicit nolog=True in the argument spec is therefore the required fix.