CVE-2026-11332: Ansible ansible-core argument injection in ansible-galaxy role install

CVE-2026-11332 · Severity: high · CVSS 7.8 · Published 2026-06-05

A security vulnerability exists in ansible-core, the central engine for the Ansible automation platform. If a user attempts to install a malicious Ansible role using the 'ansible-galaxy' command, the attacker can execute unauthorized commands on the user's computer. This could lead to a full system compromise, data theft, or the installation of malware.

Technologies: ansible-core (PyPI), Red Hat Ansible-Core. Vendors: PyPI, Red Hat.

Quick answers

Is CVE-2026-11332 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-11332 being exploited in the wild.
How severe is CVE-2026-11332?
High severity, with a CVSS score of 7.8, published 5 June 2026.
Which products and versions are affected?
ansible-core (PyPI) ECOSYSTEM:introduced=0,fixed=2.16.19rc1, ECOSYSTEM:introduced=0,fixed=2.16.19rc1,introduced=2.17.0b1,fixed=2.18.18rc1,introduced=2.19.0b1,fixed=2.19.11rc1,introduced=2.20.0b1,fixed=2.20.7rc1,introduced=2.21.0b1,fixed=2.21.1rc1; Red Hat Ansible-Core < 2.16.19rc1, >= 2.17.0b1, < 2.18.18rc1, >= 2.19.0b1, < 2.19.11rc1, >= 2.20.0b1, < 2.20.7rc1, >= 2.21.0b1, < 2.21.1rc1.
Is there a fix for CVE-2026-11332?
Yes. ansible-core (PyPI): upgrade to 2.16.19rc1, 2.21.1rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-11332 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-11332?
Check whether you run ansible-core (PyPI) or Red Hat Ansible-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • ansible-core (PyPI): upgrade to 2.16.19rc1, 2.21.1rc1 or later
    pip install "ansible-core>=2.21.1rc1"

Technical details

An argument injection vulnerability (CWE-88) exists in the 'ansible-galaxy role install' command of ansible-core. The issue stems from improper neutralization of argument delimiters when processing dependency specifications in a role's 'meta/requirements.yml' file. Specifically, the 'src' and 'name' fields are passed to 'git clone' via Python's Popen without using the '--' separator to distinguish options from positional arguments. A malicious actor can craft a role with a 'src' field containing git configuration flags (e.g., '-ccore.sshCommand=...') to execute arbitrary shell commands when a victim installs the role. Patches have been released across multiple release branches to include the necessary argument delimiters.

Affected products

  • Ansible ansible-core < 2.16.19rc1, >= 2.17.0b1, < 2.18.18rc1, >= 2.19.0b1, < 2.19.11rc1, >= 2.20.0b1, < 2.20.7rc1, >= 2.21.0b1, < 2.21.1rc1

Identifiers

  • CVE-2026-11332
  • GHSA-w8p5-mx5w-cpqj
  • PYSEC-2026-3458

Timeline

  • 2026-06-05: advisory: GitHub Advisory published
  • 2026-06-05: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.