ansible-core CVE-2026-16493

Exploitation requires that a victim actively run 'ansible-galaxy collection install' with an attacker-supplied git source URI (per AV:L/UI:R) - the vulnerable path is specifically the git-based collection install in _extract_collection_from_git(), so installs from Automation Hub, tarballs, or non-git sources are not affected. The attacker must control or influence the collection source URI (for example via a malicious requirements.yml, a poisoned documentation snippet, or a compromised internal source list) and craft it as a git argument-injection payload. Limiting factors: the flaw is local (no remote/network-reachable trigger), it demands victim action (UI:R) rather than autonomous exploitation, code runs only with the invoking user's privileges (Scope: Unchanged), and it does not apply to the already-hardened role install path fixed in CVE-2026-11332.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High), and the metrics are internally consistent with the description: exploitation is local and requires no attacker privileges (PR:N) but does require the victim to actively run an install command (UI:R), producing full confidentiality, integrity, and availability impact in the victim's security context. No EPSS score, KEV entry, POC reference, or SSVC decision data was provided, so quantitative exploitation-probability and automation signals are unavailable and cannot be asserted. The realistic risk is meaningful but gated by a social-engineering/supply-chain precondition - the victim must be induced to install a collection from an attacker-chosen git source - rather than a remotely reachable service, so this is a targeted-vector issue rather than a mass-exploitable network flaw. Note a nuance defenders should verify: PR:N is technically correct (the attacker needs no credentials) yet exploitation depends entirely on victim action and the victim's own privileges, so raw scoring can overstate ease relative to the required user interaction.

An attacker publishes or advertises a collection whose git source URI is crafted to begin with a git option payload (for example abusing option-style arguments or the ext:: transport) and persuades a developer or automation operator to install it. When the victim runs 'ansible-galaxy collection install' pointing at that source, git interprets the crafted URI as an argument and the attacker's command executes with the victim's privileges. No public exploit code was identified in the provided data, but the local, low-complexity nature of the flaw makes a working payload straightforward to construct.