# CVE-2026-11332: Ansible ansible-core argument injection in ansible-galaxy role install

Source: https://junglewise.ai/threats/cve-2026-11332-ansible-ansible-core-argument-injection-in-ansible-galaxy-role  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-11332 · Severity: high · CVSS 7.8 · Published 2026-06-05

A security vulnerability exists in ansible-core, the central engine for the Ansible automation platform. If a user attempts to install a malicious Ansible role using the 'ansible-galaxy' command, the attacker can execute unauthorized commands on the user's computer. This could lead to a full system compromise, data theft, or the installation of malware.

Technologies: [ansible-core (PyPI)](https://junglewise.ai/threats/technologies/pypi-ansible-core), [Red Hat Ansible-Core](https://junglewise.ai/threats/technologies/ansible-core). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-11332 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-11332 being exploited in the wild.

**How severe is CVE-2026-11332?** High severity, with a CVSS score of 7.8, published 5 June 2026.

**Which products and versions are affected?** ansible-core (PyPI) ECOSYSTEM:introduced=0,fixed=2.16.19rc1, ECOSYSTEM:introduced=0,fixed=2.16.19rc1,introduced=2.17.0b1,fixed=2.18.18rc1,introduced=2.19.0b1,fixed=2.19.11rc1,introduced=2.20.0b1,fixed=2.20.7rc1,introduced=2.21.0b1,fixed=2.21.1rc1; Red Hat Ansible-Core < 2.16.19rc1, >= 2.17.0b1, < 2.18.18rc1, >= 2.19.0b1, < 2.19.11rc1, >= 2.20.0b1, < 2.20.7rc1, >= 2.21.0b1, < 2.21.1rc1.

**Is there a fix for CVE-2026-11332?** Yes. ansible-core (PyPI): upgrade to 2.16.19rc1, 2.21.1rc1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-11332 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-11332?** Check whether you run ansible-core (PyPI) or Red Hat Ansible-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- ansible-core (PyPI): upgrade to 2.16.19rc1, 2.21.1rc1 or later

  ```sh
  pip install "ansible-core>=2.21.1rc1"
  ```


## Technical details

An argument injection vulnerability (CWE-88) exists in the 'ansible-galaxy role install' command of ansible-core. The issue stems from improper neutralization of argument delimiters when processing dependency specifications in a role's 'meta/requirements.yml' file. Specifically, the 'src' and 'name' fields are passed to 'git clone' via Python's Popen without using the '--' separator to distinguish options from positional arguments. A malicious actor can craft a role with a 'src' field containing git configuration flags (e.g., '-ccore.sshCommand=...') to execute arbitrary shell commands when a victim installs the role. Patches have been released across multiple release branches to include the necessary argument delimiters.

## Affected products

- Ansible ansible-core < 2.16.19rc1, >= 2.17.0b1, < 2.18.18rc1, >= 2.19.0b1, < 2.19.11rc1, >= 2.20.0b1, < 2.20.7rc1, >= 2.21.0b1, < 2.21.1rc1

## Identifiers

- CVE-2026-11332
- GHSA-w8p5-mx5w-cpqj
- PYSEC-2026-3458

## Timeline

- 2026-06-05: advisory: GitHub Advisory published
- 2026-06-05: disclosed: NVD publication date

## References

- [https://access.redhat.com/security/cve/CVE-2026-11332](https://access.redhat.com/security/cve/CVE-2026-11332)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2485379](https://bugzilla.redhat.com/show_bug.cgi?id=2485379)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json)
- [https://github.com/ansible/ansible/pull/87070](https://github.com/ansible/ansible/pull/87070)
- [https://github.com/ansible/ansible/commit/edee59aa15abcc74d920bb3e9c3835ab8db05a2f](https://github.com/ansible/ansible/commit/edee59aa15abcc74d920bb3e9c3835ab8db05a2f)

## Related threats

- [Red Hat ansible-core git module argument injection](https://junglewise.ai/threats/cve-2026-84503-a-flaw-was-found-in-ansible-core-s-ansible-builtin-git-module-the)
- [Red Hat ansible-core path traversal in collection install](https://junglewise.ai/threats/cve-2026-89091-a-flaw-was-found-in-ansible-core-when-installing-a-collection)
- [Red Hat ansible-core argument injection in ansible-galaxy collection install](https://junglewise.ai/threats/cve-2026-16493-red-hat-ansible-core-argument-injection-in-ansible-galaxy)
- [PYSEC-2026-1123 - Ansible-Core vulnerable to content protections bypass](https://junglewise.ai/threats/cve-2024-11079-ansible-core-vulnerable-to-content-protections-bypass)
- [PYSEC-2026-1121 - ansible-core Incorrect Authorization vulnerability](https://junglewise.ai/threats/cve-2024-9902-ansible-user-module-incorrect-authorization-in-ssh-key-handling)