Bug 2485379 (CVE-2026-11332)

Summary:	CVE-2026-11332 ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	anthomas, bagasse, brasmith, cahl, cochase, dranck, dschmidt, eglynn, ehelms, erezende, ggainey, gparvin, jjoyce, jlanda, jmitchel, jpasqual, jsamir, juwatts, jwong, kbempah, kshier, ljawale, mburns, mdellweg, mgarciac, mhulan, mrunge, msilmser, nmoumoul, omaciel, osousa, pakotvan, pcreech, rchan, rhaigner, rhel-process-autobot, rjohnson, sadas, simaishi, smallamp, smcdonal, solenoci, stcannon, sthirugn, teagle, tmalecek, ttakamiy, vimartin, watson-tool-maintainers, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2485397
Bug Blocks:

Description OSIDB Bzimport 2026-06-05 07:28:27 UTC

A flaw was found in ansible-core's ansible-galaxy command. When installing a role, ansible-galaxy processes a meta/requirements.yml file that lists role dependencies. The src and name fields from this file are passed as arguments to git clone via Python's Popen without a -- separator to delimit options from positional arguments. A malicious role author can craft a dependency entry where the src field contains a git configuration flag (e.g., -ccore.sshCommand=sh -c "malicious_command") and the name field provides a valid repository URL. This results in arbitrary code execution on the system of any user who installs the role. The fix is to insert -- before the positional arguments in the git clone command list.

Comment 3 errata-xmlrpc 2026-07-20 15:53:26 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.7 for RHEL 9
  Red Hat Ansible Automation Platform 2.7 for RHEL 10

Via RHSA-2026:42080 https://access.redhat.com/errata/RHSA-2026:42080

Comment 4 errata-xmlrpc 2026-07-20 15:59:22 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:42078 https://access.redhat.com/errata/RHSA-2026:42078

Comment 5 errata-xmlrpc 2026-07-20 16:02:41 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:42079 https://access.redhat.com/errata/RHSA-2026:42079

Comment 7 errata-xmlrpc 2026-08-19 20:08:06 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:57148 https://access.redhat.com/errata/RHSA-2026:57148

Comment 8 errata-xmlrpc 2026-08-19 20:37:10 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:57149 https://access.redhat.com/errata/RHSA-2026:57149

Comment 9 errata-xmlrpc 2026-09-03 22:01:32 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.18 for RHEL 9

Via RHSA-2026:63386 https://access.redhat.com/errata/RHSA-2026:63386

Comment 10 errata-xmlrpc 2026-09-03 22:57:09 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.17 for RHEL 9

Via RHSA-2026:63387 https://access.redhat.com/errata/RHSA-2026:63387