Junglewise Threat Intelligence

CVE-2026-11332: Ansible ansible-core argument injection in ansible-galaxy role install

CVE-2026-11332 · Severity: high · CVSS 7.8 · Published 2026-06-05

Technologies: ansible-core (PyPI). Vendors: Red Hat, PyPI, Ansible.

Executive brief

A security vulnerability exists in ansible-core, the central engine for the Ansible automation platform. If a user attempts to install a malicious Ansible role using the 'ansible-galaxy' command, the attacker can execute unauthorized commands on the user's computer. This could lead to a full system compromise, data theft, or the installation of malware.

Technical details

An argument injection vulnerability (CWE-88) exists in the 'ansible-galaxy role install' command of ansible-core. The issue stems from improper neutralization of argument delimiters when processing dependency specifications in a role's 'meta/requirements.yml' file. Specifically, the 'src' and 'name' fields are passed to 'git clone' via Python's Popen without using the '--' separator to distinguish options from positional arguments. A malicious actor can craft a role with a 'src' field containing git configuration flags (e.g., '-ccore.sshCommand=...') to execute arbitrary shell commands when a victim installs the role. Patches have been released across multiple release branches to include the necessary argument delimiters.

Affected products

  • Ansible ansible-core < 2.16.19rc1, >= 2.17.0b1, < 2.18.18rc1, >= 2.19.0b1, < 2.19.11rc1, >= 2.20.0b1, < 2.20.7rc1, >= 2.21.0b1, < 2.21.1rc1

Timeline

  • 2026-06-05: advisory: GitHub Advisory published
  • 2026-06-05: disclosed: NVD publication date

References

Related threats