What’s Vulnerable › Vulnerabilities

CVE-2026-79717: Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-25 · updated 2026-08-28
• Weakness: CWE-918

Description

A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata endpoints. A background worker fetches that URL without checking the destination, which lets the attacker probe internal services and enumerate reachable IP addresses. The HTTP client is also configured without an overall timeout, so a slow or non-responsive target can pin workers and cause a denial of service.

Affected products

• Red Hat Ansible Automation Platform 2: all versions

References

• https://access.redhat.com/security/cve/CVE-2026-79717
• https://bugzilla.redhat.com/show_bug.cgi?id=2523431
• https://github.com/ansible/galaxy_ng

Get alerted when CVE-2026-79717 or the next vulnerability affects your stack