CVE-2026-71465: Ansible AWX Privilege Escalation Vulnerability

CVE-2026-71465 Overview

CVE-2026-71465 is an argument injection weakness in the RunAdHocCommand.build_args() function within Ansible AWX. The function appends the limit parameter as a bare positional argument using args.append(limit) instead of the safer args.extend(['-l', limit]) pattern used by RunJob. A limit value beginning with - is then parsed by the Ansible command line interface (CLI) as an option rather than as data. Red Hat has issued multiple advisories addressing the flaw across affected product streams.

Critical Impact
Exploitation is presently constrained to short-circuit CLI flags such as --version and --help because the injected element displaces the required pattern positional. Impact would escalate if ansible-core ever provided a default pattern.

Affected Products

Ansible AWX RunAdHocCommand execution path
Red Hat Ansible Automation Platform components referenced in RHSA-2026:71113 and RHSA-2026:71114
Red Hat Ansible Automation Platform components referenced in RHSA-2026:71177 and RHSA-2026:71179

Discovery Timeline

2026-09-23 - CVE-2026-71465 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-71465

Vulnerability Analysis

The weakness maps to CWE-88: Improper Neutralization of Argument Delimiters in a Command. Ansible AWX constructs the argument list for ad-hoc command execution by appending user-controlled fields directly onto the CLI invocation. Because limit is placed as a bare positional token, a value that begins with - is interpreted by the Ansible CLI as an option flag rather than as a host pattern limiter. The RunJob code path avoids this behavior by explicitly prepending the -l switch, isolating the value as an option argument.

Root Cause

The root cause is inconsistent argument construction between RunAdHocCommand.build_args() and RunJob. RunAdHocCommand uses args.append(limit) while RunJob uses args.extend(['-l', limit]). Without the leading -l sentinel, the argument parser treats a leading dash in limit as the start of a new option, enabling CLI option injection.

Attack Vector

An authenticated user with permission to launch ad-hoc commands supplies a limit value that begins with -, such as --version or --help. The Ansible CLI consumes the injected token as an option and short-circuits execution. The injected element also displaces the required pattern positional, which currently prevents attackers from injecting execution-altering options. If a future ansible-core release supplied a default pattern, the same primitive could be extended to more damaging flags. Refer to the Red Hat CVE Analysis for CVE-2026-71465 for further technical context.

Detection Methods for CVE-2026-71465

Indicators of Compromise

Ad-hoc command job records where the limit field starts with a - character, particularly values like --version, --help, or other Ansible CLI switches.
AWX job output containing Ansible CLI banner text (for example version strings) instead of expected play recap output.
Repeated short-lived ad-hoc jobs that terminate immediately without executing tasks against target hosts.

Detection Strategies

Parse AWX job launch payloads and audit logs for limit values matching the regular expression ^-.
Correlate ad-hoc command submissions with process telemetry on execution nodes to identify ansible invocations carrying option-shaped positional arguments.
Baseline normal limit usage per user and alert on deviations that introduce dash-prefixed tokens.

Monitoring Recommendations

Forward AWX API audit events and job event streams to a centralized analytics platform for retrospective search.
Enable verbose logging on Ansible execution environments so full CLI argument vectors are captured for review.
Alert on newly created ad-hoc command templates or workflows submitted by low-privilege accounts.

How to Mitigate CVE-2026-71465

Immediate Actions Required

Apply the fixed packages referenced in RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179.
Restrict ad-hoc command execution permissions in AWX to trusted operators only.
Review recent ad-hoc job history for limit values beginning with - and investigate the associated user accounts.

Patch Information

Red Hat has published fixes across multiple Ansible Automation Platform channels. Review the Red Hat CVE page for CVE-2026-71465 and the associated Bugzilla report #2512375 to identify the correct errata for each installed component, then apply the vendor-supplied packages through your normal patch management process.

Workarounds

Enforce server-side validation that rejects limit values beginning with - before job submission.
Wrap AWX behind an API gateway or policy engine that normalizes ad-hoc command payloads and strips option-shaped tokens.
Reduce the blast radius by scoping ad-hoc command RBAC roles to specific inventories and teams until patching completes.

bash

# Configuration example: reject dash-prefixed limit values at an ingress policy layer
# Pseudocode for a request-validation hook
if [[ "${AWX_LIMIT}" == -* ]]; then
  echo "Rejected: 'limit' must not begin with '-'" >&2
  exit 1
fi