Executive brief
A security vulnerability exists in ansible-core, the central engine for the Ansible automation platform. When a user attempts to install a collection from a malicious source using the 'ansible-galaxy' command, the system can be tricked into running unauthorized commands. This could allow an attacker to take control of the system where the automation is being managed, potentially leading to data theft or service disruption.
Technical details
An argument injection vulnerability exists in the _extract_collection_from_git() function within ansible-core's concrete_artifact_manager.py. The software fails to use the '--' (end-of-options) separator when constructing git clone commands with user-supplied URLs. An attacker can provide a crafted URI containing git argument injection payloads (such as -ccore.sshCommand) to achieve arbitrary command execution when a user runs 'ansible-galaxy collection install'. This issue represents an incomplete fix for CVE-2026-11332, as the hardening applied to the role install path was not implemented for the collection install path. The vulnerability is present in the devel, stable-2.18, and stable-2.17 branches.
Affected products
- Red Hat ansible-core stable-2.18, stable-2.17, devel
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Satellite 6
Timeline
- 2026-07-21: disclosed: Vulnerability reported via Red Hat Bugzilla and NVD