CVE-2026-11332
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A flaw in ansible-core: the ansible-galaxy role install command processes dependency specifications from meta/requirements.yml. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags via the src field, allowing arbitrary code execution on the machine of a user who installs the role.
Risk Assessment
The organization is at risk of remote code execution when installing a role from an untrusted source, potentially leading to system compromise.
Recommendation
Upgrade ansible-core to a patched version and avoid installing roles from untrusted sources.
Other vulnerabilities in ansible-core
See all- CVE-2026-89091High
A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory.
- CVE-2026-71465Low
RunAdHocCommand.build_args() appends limit as a bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob. A limit beginning with - is parsed as an ansible CLI option. Currently limited to short-circuit flags (--version, --help) since the injected element displaces the required pattern positional. Would escalate if ansible-core ever defaults pattern.
- CVE-2026-16493High
In ansible-core, the _extract_collection_from_git() function in concrete_artifact_manager.py constructs git clone commands without a '--' separator before user-supplied URLs. An attacker can provide a malicious collection source URI containing git argument injection, leading to arbitrary command execution during collection installation.
- CVE-2024-11079Medium
A flaw in Ansible-Core allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content, leading to arbitrary code execution.
Original NVD description (English source)
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS