{"id":"CVE-2026-11332","title":"A flaw was found in ansible-core","summary":"A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can in…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-88"],"vendor":"Red Hat","product":"ansible-core","affected":["ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","ansible-core (all versions)","pulpcore-obsolete-packages (all versions)","python3.12-pulpcore (all versions)","ansible-core (all versions)","ansible-automation-platform-25/ee-minimal-rhel8 (all versions)","ansible-automation-platform-25/ee-supported-rhel8 (all versions)","ansible-automation-platform-25/lightspeed-rhel8 (all versions)","ansible-automation-platform-25/ee-minimal-rhel9 (all versions)","ansible-automation-platform-25/ee-supported-rhel9 (all versions)","ansible-automation-platform-26/de-minimal-rhel9 (all versions)","ansible-automation-platform-26/de-supported-rhel9 (all versions)","ansible-automation-platform-26/eda-controller-rhel9 (all versions)","ansible-automation-platform-26/lightspeed-rhel9 (all versions)","ansible-automation-platform-27/de-minimal-rhel9 (all versions)","ansible-automation-platform-27/de-supported-rhel9 (all versions)","ansible-automation-platform-27/eda-controller-rhel9 (all versions)","ansible-automation-platform-27/lightspeed-rhel9 (all versions)","discovery/discovery-server-rhel9 (all versions)","mta/mta-rhel9-operator (all versions)","migration-toolkit-virtualization/mtv-rhel9-operator (all versions)","mtv-candidate/mtv-rhel9-operator (all versions)","openshift-service-mesh/kiali-rhel9-operator","rhacm2/volsync-operator-bundle","rhacm2/volsync-rhel9","ansible-automation-platform-24/hub-rhel8 (all versions)","ansible-automation-platform-25/controller-rhel8-operator (all versions)","ansible-automation-platform-25/de-minimal-rhel8 (all versions)","ansible-automation-platform-25/de-supported-rhel8 (all versions)","ansible-automation-platform-25/eda-controller-rhel8 (all versions)","ansible-automation-platform-25/eda-controller-rhel8-operator","ansible-automation-platform-25/gateway-rhel8-operator (all versions)","ansible-automation-platform-25/hub-rhel8 (all versions)","ansible-automation-platform-25/hub-rhel8-operator (all versions)","ansible-automation-platform-25/lightspeed-rhel8-operator","ansible-automation-platform-25/platform-resource-rhel8-operator (all versions)","ansible-automation-platform-25/platform-resource-runner-rhel8 (all versions)","ansible-automation-platform-26/controller-rhel9-operator (all versions)"],"patched":["ansible_automation_platform_2_6_for_rhel 10","ansible_automation_platform_2_7_for_rhel 10","ansible_automation_platform_2_5_for_rhel 8","ansible_automation_platform_2_5_for_rhel 9","ansible_automation_platform_2_6_for_rhel 9","ansible_automation_platform_2_7_for_rhel 9","satellite_6_17_for_rhel 9","satellite_6_18_for_rhel 9","satellite_6_19_for_rhel 9","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_8","enterprise_linux_appstream_v_9","ansible_automation_platform 2.5","ansible_automation_platform 2.6","ansible_automation_platform 2.7","discovery 2"],"published":"2026-06-05","updated":"2026-09-15","sourceUpdated":"2026-09-15T12:16:56.910","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-11332","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:42078","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:42079","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:42080","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:46836","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50340","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50344","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50357","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:50479","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:57148","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:57149","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63385","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63386","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:63387","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:66248","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67465","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67466","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:67467","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-11332","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485379","label":"secalert@redhat.com"},{"url":"https://github.com/ansible/ansible","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:42078","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42079","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:42080","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:46836","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50340","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50344","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50357","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:50479","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57148","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:57149","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:63385","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:63386","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:63387","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:66248","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:67465","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:67466","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/errata/RHSA-2026:67467","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://access.redhat.com/security/cve/CVE-2026-11332","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2485379","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json","label":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-11332"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-11332"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-06-05T15:43:53.403669Z"},"epss":0.00222,"epssPercentile":0.13005,"ingestedAt":"2026-07-11T13:13:24.464Z","slug":"CVE-2026-11332","body":"## Overview\n\nA flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:42079** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42079)\n- **RHSA-2026:42080** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 for RHEL 10, Red Hat Ansible Automation Platform 2.7 for RHEL 9 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42080)\n- **RHSA-2026:42078** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42078)\n- **RHSA-2026:63387** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63387)\n- **RHSA-2026:63386** · Red Hat · fixed in: Red Hat Satellite 6.18 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63386)\n- **RHSA-2026:63385** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63385)\n- **RHSA-2026:57148** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57148)\n- **RHSA-2026:66248** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66248)\n- **RHSA-2026:57149** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57149)\n- **RHSA-2026:50357** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50357)\n- **RHSA-2026:50344** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50344)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Migration Toolkit for Virtualization, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat OpenShift Container Platform 4, Self-service automation portal 2 · no fix planned: Migration Toolkit for Virtualization, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Migration Toolkit for Applications 8, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json)\n- **RHSA-2026:67465** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67465)\n- **RHSA-2026:67467** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67467)\n- **RHSA-2026:67466** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67466)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}