CVE-2026-11332

HIGH7.8

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

Published Jun 5, 2026

Modified 5 days ago

Details

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

References

WEB

https://access.redhat.com/security/cve/CVE-2026-11332

WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2485379

WEB

https://github.com/ansible/ansible

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-11332

CVSS Analysis

CVSS v3.1

7.8