Executive brief
A security vulnerability exists in ansible-core, the central engine for the Ansible automation platform. If a user attempts to install a malicious Ansible role using the 'ansible-galaxy' command, the attacker can execute unauthorized commands on the user's computer. This could lead to a full system compromise, data theft, or the installation of malware.
Technical details
An argument injection vulnerability (CWE-88) exists in the 'ansible-galaxy role install' command of ansible-core. The issue stems from improper neutralization of argument delimiters when processing dependency specifications in a role's 'meta/requirements.yml' file. Specifically, the 'src' and 'name' fields are passed to 'git clone' via Python's Popen without using the '--' separator to distinguish options from positional arguments. A malicious actor can craft a role with a 'src' field containing git configuration flags (e.g., '-ccore.sshCommand=...') to execute arbitrary shell commands when a victim installs the role. Patches have been released across multiple release branches to include the necessary argument delimiters.
Affected products
- Ansible ansible-core < 2.16.19rc1, >= 2.17.0b1, < 2.18.18rc1, >= 2.19.0b1, < 2.19.11rc1, >= 2.20.0b1, < 2.20.7rc1, >= 2.21.0b1, < 2.21.1rc1
Timeline
- 2026-06-05: advisory: GitHub Advisory published
- 2026-06-05: disclosed: NVD publication date
References
- https://access.redhat.com/security/cve/CVE-2026-11332
- https://bugzilla.redhat.com/show_bug.cgi?id=2485379
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json
- https://github.com/ansible/ansible/pull/87070
- https://github.com/ansible/ansible/commit/edee59aa15abcc74d920bb3e9c3835ab8db05a2f