{"id":"CVE-2026-71465","published":"2026-09-23T19:19:03.500","lastModified":"2026-09-24T14:51:56.593","description":"RunAdHocCommand.build_args() appends limit as bare\n              positional (args.append(limit)) instead of using\n              args.extend(['-l', limit]) like RunJob. A limit beginning\n              with - is parsed as an ansible CLI option. Currently\n              limited to short-circuit flags (--version, --help) since\n              injected element displaces required pattern positional.\n              Would escalate if ansible-core ever defaults pattern.","cvssScore":3.1,"cvssSeverity":"LOW","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","cwes":["CWE-88"],"vendors":[],"products":[],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:71113","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:71114","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:71177","tags":[]},{"url":"https://access.redhat.com/errata/RHSA-2026:71179","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71465","tags":[]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2512375","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}