Vulnerability in Red Hat Migration Toolkit For Applications 8
CVE-2026-84503
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- Red Hat Migration Toolkit For Applications 8
- Red Hat Migration Toolkit For Virtualization
- Red Hat Ansible Automation Platform 2
- Red Hat Ansible Automation Platform Core 2
- Red Hat Certification Program For Enterprise Linux 9
- Red Hat Discovery 2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Openshift Container Platform 4
Weakness classification (CWE)
References
- access.redhat.com/security/cve/CVE-2026-84503 (vdb-entry)
- bugzilla.redhat.com/show_bug.cgi (issue-tracking)
Frequently asked questions
- What is CVE-2026-84503?
- CVE-2026-84503 is a medium-severity vulnerability in Red Hat Migration Toolkit For Applications 8, classified under Argument Injection. CVSS score: 6.7/10. Published 2026-11-09.
- How severe is CVE-2026-84503?
- Medium severity. CVSS v3 base score is 6.7 out of 10.