CVE-2026-11332
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
A flaw in ansible-core: the ansible-galaxy role install command processes dependency specifications from meta/requirements.yml. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags via the src field, allowing arbitrary code execution on the machine of a user who installs the role.
Risk Assessment
The organization is at risk of remote code execution when installing a role from an untrusted source, potentially leading to system compromise.
Recommendation
Upgrade ansible-core to a patched version and avoid installing roles from untrusted sources.
Other vulnerabilities in ansible-core
See all- CVE-2026-16493High
In ansible-core, the _extract_collection_from_git() function in concrete_artifact_manager.py constructs git clone commands without a '--' separator before user-supplied URLs. An attacker can provide a malicious collection source URI containing git argument injection, leading to arbitrary command execution during collection installation.
- CVE-2024-11079Medium
A flaw in Ansible-Core allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content, leading to arbitrary code execution.
Original NVD description (English source)
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.