--- id: CVE-2026-11332 title: A flaw was found in ansible-core summary: >- A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can in… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H' cwe: - CWE-88 vendor: Red Hat product: ansible-core affected: - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - ansible-core (all versions) - pulpcore-obsolete-packages (all versions) - python3.12-pulpcore (all versions) - ansible-core (all versions) - ansible-automation-platform-25/ee-minimal-rhel8 (all versions) - ansible-automation-platform-25/ee-supported-rhel8 (all versions) - ansible-automation-platform-25/lightspeed-rhel8 (all versions) - ansible-automation-platform-25/ee-minimal-rhel9 (all versions) - ansible-automation-platform-25/ee-supported-rhel9 (all versions) - ansible-automation-platform-26/de-minimal-rhel9 (all versions) - ansible-automation-platform-26/de-supported-rhel9 (all versions) - ansible-automation-platform-26/eda-controller-rhel9 (all versions) - ansible-automation-platform-26/lightspeed-rhel9 (all versions) - ansible-automation-platform-27/de-minimal-rhel9 (all versions) - ansible-automation-platform-27/de-supported-rhel9 (all versions) - ansible-automation-platform-27/eda-controller-rhel9 (all versions) - ansible-automation-platform-27/lightspeed-rhel9 (all versions) - discovery/discovery-server-rhel9 (all versions) - mta/mta-rhel9-operator (all versions) - migration-toolkit-virtualization/mtv-rhel9-operator (all versions) - mtv-candidate/mtv-rhel9-operator (all versions) - openshift-service-mesh/kiali-rhel9-operator - rhacm2/volsync-operator-bundle - rhacm2/volsync-rhel9 - ansible-automation-platform-24/hub-rhel8 (all versions) - ansible-automation-platform-25/controller-rhel8-operator (all versions) - ansible-automation-platform-25/de-minimal-rhel8 (all versions) - ansible-automation-platform-25/de-supported-rhel8 (all versions) - ansible-automation-platform-25/eda-controller-rhel8 (all versions) - ansible-automation-platform-25/eda-controller-rhel8-operator - ansible-automation-platform-25/gateway-rhel8-operator (all versions) - ansible-automation-platform-25/hub-rhel8 (all versions) - ansible-automation-platform-25/hub-rhel8-operator (all versions) - ansible-automation-platform-25/lightspeed-rhel8-operator - >- ansible-automation-platform-25/platform-resource-rhel8-operator (all versions) - ansible-automation-platform-25/platform-resource-runner-rhel8 (all versions) - ansible-automation-platform-26/controller-rhel9-operator (all versions) patched: - ansible_automation_platform_2_6_for_rhel 10 - ansible_automation_platform_2_7_for_rhel 10 - ansible_automation_platform_2_5_for_rhel 8 - ansible_automation_platform_2_5_for_rhel 9 - ansible_automation_platform_2_6_for_rhel 9 - ansible_automation_platform_2_7_for_rhel 9 - satellite_6_17_for_rhel 9 - satellite_6_18_for_rhel 9 - satellite_6_19_for_rhel 9 - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_8 - enterprise_linux_appstream_v_9 - ansible_automation_platform 2.5 - ansible_automation_platform 2.6 - ansible_automation_platform 2.7 - discovery 2 published: '2026-06-05' updated: '2026-09-15' sourceUpdated: '2026-09-15T12:16:56.910' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11332' references: - url: 'https://access.redhat.com/errata/RHSA-2026:42078' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:42079' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:42080' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:46836' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:50340' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:50344' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:50357' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:50479' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:57148' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:57149' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:63385' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:63386' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:63387' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:66248' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:67465' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:67466' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:67467' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-11332' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2485379' label: secalert@redhat.com - url: 'https://github.com/ansible/ansible' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:42078' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42079' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:42080' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:46836' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:50340' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:50344' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:50357' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:50479' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:57148' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:57149' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:63385' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:63386' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:63387' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:66248' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:67465' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:67466' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/errata/RHSA-2026:67467' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://access.redhat.com/security/cve/CVE-2026-11332' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2485379' label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json label: 0b0ca135-0b70-47e7-9f44-1890c2a1c46c - url: 'https://www.cve.org/CVERecord?id=CVE-2026-11332' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-11332' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: total timestamp: '2026-06-05T15:43:53.403669Z' epss: 0.00222 epssPercentile: 0.11394 ingestedAt: '2026-07-11T13:13:24.464Z' --- ## Overview A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install. ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:42079** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 10, Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42079) - **RHSA-2026:42080** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.7 for RHEL 10, Red Hat Ansible Automation Platform 2.7 for RHEL 9 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42080) - **RHSA-2026:42078** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9 · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:42078) - **RHSA-2026:63387** · Red Hat · fixed in: Red Hat Satellite 6.17 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63387) - **RHSA-2026:63386** · Red Hat · fixed in: Red Hat Satellite 6.18 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63386) - **RHSA-2026:63385** · Red Hat · fixed in: Red Hat Satellite 6.19 for RHEL 9 · released 2026-09-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:63385) - **RHSA-2026:57148** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57148) - **RHSA-2026:66248** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8) · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66248) - **RHSA-2026:57149** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-08-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:57149) - **RHSA-2026:50357** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50357) - **RHSA-2026:50344** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50344) - **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Migration Toolkit for Virtualization, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Red Hat OpenShift Container Platform 4, Self-service automation portal 2 · no fix planned: Migration Toolkit for Virtualization, Red Hat Ansible Automation Platform 2, Red Hat Ansible Automation Platform Ansible Core 2, Migration Toolkit for Applications 8, … · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json) - **RHSA-2026:67465** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67465) - **RHSA-2026:67467** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67467) - **RHSA-2026:67466** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67466)