CVE-2026-11332: Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-05 · updated 2026-10-31
Weakness: CWE-88

Description

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

Affected products

Red Hat Migration Toolkit for Applications 8: all versions
Red Hat Migration Toolkit for Virtualization: all versions
Red Hat Ansible Automation Platform 2: all versions
Red Hat Ansible Automation Platform 2.5: all versions — fixed in 1785381341
Red Hat Ansible Automation Platform 2.5 for RHEL 8: all versions — fixed in 1:2.16.19-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9: all versions — fixed in 1:2.16.19-1.el9ap
Red Hat Ansible Automation Platform 2.6: all versions — fixed in 1785647559
Red Hat Ansible Automation Platform 2.6 for RHEL 10: all versions — fixed in 2:2.16.19-1.el10ap
Red Hat Ansible Automation Platform 2.6 for RHEL 9: all versions — fixed in 1:2.16.19-1.el9ap
Red Hat Ansible Automation Platform 2.7: all versions — fixed in 1785446384
Red Hat Ansible Automation Platform 2.7 for RHEL 10: all versions — fixed in 2:2.16.19-1.el10ap
Red Hat Ansible Automation Platform 2.7 for RHEL 9: all versions — fixed in 1:2.16.19-1.el9ap
Red Hat Ansible Automation Platform Ansible Core 2: all versions
Red Hat Discovery 2: all versions — fixed in 1784821670
Red Hat Enterprise Linux 10: all versions — fixed in 1:2.16.16-2.el10_2.1
Red Hat Enterprise Linux 10.0 Extended Update Support: all versions — fixed in 1:2.16.14-1.el10_0.1
Red Hat Enterprise Linux 8: all versions — fixed in 0:2.16.3-4.el8_10
Red Hat Enterprise Linux 9: all versions — fixed in 1:2.14.18-3.el9_8.1
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions: all versions — fixed in 1:2.14.14-1.el9_4.1
Red Hat Enterprise Linux 9.6 Extended Update Support: all versions — fixed in 1:2.14.18-1.el9_6.1
Red Hat OpenShift Container Platform 4.21: all versions — fixed in 1791981285
Red Hat OpenShift Container Platform 5: all versions
Red Hat Satellite 6.17 for RHEL 9: all versions — fixed in 1:2.16.19-1.el9sat
Red Hat Satellite 6.18 for RHEL 9: all versions — fixed in 1:2.16.19-1.el9sat
Red Hat Satellite 6.19 for RHEL 9: all versions — fixed in 1:2.16.19-1.el9sat
Red Hat Self-service automation portal 2: all versions

How to fix

Upgrade to a fixed version: Red Hat Ansible Automation Platform 2.5 1785381341; Red Hat Ansible Automation Platform 2.5 for RHEL 8 1:2.16.19-1.el8ap; Red Hat Ansible Automation Platform 2.5 for RHEL 9 1:2.16.19-1.el9ap; Red Hat Ansible Automation Platform 2.6 1785647559; Red Hat Ansible Automation Platform 2.6 for RHEL 10 2:2.16.19-1.el10ap; Red Hat Ansible Automation Platform 2.6 for RHEL 9 1:2.16.19-1.el9ap; Red Hat Ansible Automation Platform 2.7 1785446384; Red Hat Ansible Automation Platform 2.7 for RHEL 10 2:2.16.19-1.el10ap; Red Hat Ansible Automation Platform 2.7 for RHEL 9 1:2.16.19-1.el9ap; Red Hat Discovery 2 1784821670; Red Hat Enterprise Linux 10 1:2.16.16-2.el10_2.1; Red Hat Enterprise Linux 10.0 Extended Update Support 1:2.16.14-1.el10_0.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-11332 or the next vulnerability affects your stack