CVE-2026-71465

Name of the Vulnerable Software and Affected Versions ansible-core (affected versions not specified)

Description The build args() function within RunAdHocCommand incorrectly appends the limit variable as a bare positional argument instead of using the -l flag. This allows a limit value starting with a hyphen to be interpreted as an ansible CLI option. Currently, this is limited to short-circuit flags such as --version and --help because the injected element displaces the required pattern positional argument.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.