CVE-2026-11332

HIGH

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

Title source: cna
STIX 2.1

Description

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

References (8)

Core 8
Core References
Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2026-11332
Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat
RHBZ#2485379
https://bugzilla.redhat.com/show_bug.cgi?id=2485379
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:42078
https://access.redhat.com/errata/RHSA-2026:42078
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:42079
https://access.redhat.com/errata/RHSA-2026:42079
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:42080
https://access.redhat.com/errata/RHSA-2026:42080
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2026:46836
https://access.redhat.com/errata/RHSA-2026:46836

Scores

CVSS v3 7.8
EPSS 0.0020
EPSS Percentile 9.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-88
Status published
Products (26)
pypi/ansible-core 0 - 2.16.19rc1PyPI
pypi/ansible-core 2.17.0b1 - 2.18.18rc1PyPI
pypi/ansible-core 2.19.0b1 - 2.19.11rc1PyPI
pypi/ansible-core 2.20.0b1 - 2.20.7rc1PyPI
pypi/ansible-core 2.21.0b1 - 2.21.1rc1PyPI
Red Hat/Migration Toolkit for Applications 8
Red Hat/Migration Toolkit for Virtualization
Red Hat/OpenShift Service Mesh 3
Red Hat/Red Hat Advanced Cluster Management for Kubernetes 2
Red Hat/Red Hat Ansible Automation Platform 2
... and 16 more
Published Jun 05, 2026
Tracked Since Jun 05, 2026