Description
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
Default version status: affected
1:2.16.19-1.el8ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
Default version status: affected
1:2.16.19-1.el9ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 10
Default version status: affected
2:2.16.19-1.el10ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
Default version status: affected
1:2.16.19-1.el9ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.7 for RHEL 10
Default version status: affected
2:2.16.19-1.el10ap to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.7 for RHEL 9
Default version status: affected
1:2.16.19-1.el9ap to < *unaffected
Red Hat Red Hat Enterprise Linux 10
Default version status: affected
1:2.16.16-2.el10_2.1 to < *unaffected
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
Default version status: affected
1:2.16.14-1.el10_0.1 to < *unaffected
Red Hat Red Hat Enterprise Linux 8
Default version status: affected
0:2.16.3-4.el8_10 to < *unaffected
Red Hat Red Hat Enterprise Linux 9
Default version status: affected
1:2.14.18-3.el9_8.1 to < *unaffected
Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Default version status: affected
1:2.14.14-1.el9_4.1 to < *unaffected
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
Default version status: affected
1:2.14.18-1.el9_6.1 to < *unaffected
Red Hat Red Hat Satellite 6.17 for RHEL 9
Default version status: affected
1:2.16.19-1.el9sat to < *unaffected
Red Hat Red Hat Satellite 6.18 for RHEL 9
Default version status: affected
1:2.16.19-1.el9sat to < *unaffected
Red Hat Red Hat Satellite 6.18 for RHEL 9
Default version status: affected
0:1.3.1-5.el9pc to < *unaffected
Red Hat Red Hat Satellite 6.18 for RHEL 9
Default version status: affected
0:3.73.30-3.el9pc to < *unaffected
Red Hat Red Hat Satellite 6.19 for RHEL 9
Default version status: affected
1:2.16.19-1.el9sat to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.5
Default version status: affected
1785381341 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.5
Default version status: affected
1785429657 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.5
Default version status: affected
1785430174 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.5
Default version status: affected
1785425335 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.5
Default version status: affected
1785449441 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.6
Default version status: affected
1785647559 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.6
Default version status: affected
1785649812 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.6
Default version status: affected
1785633038 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.6
Default version status: affected
1785775360 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.7
Default version status: affected
1785446384 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.7
Default version status: affected
1785448519 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.7
Default version status: affected
1785374869 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.7
Default version status: affected
1785375273 to < *unaffected
Red Hat Red Hat Ansible Automation Platform 2.7
Default version status: affected
1792138710 to < *unaffected
Red Hat Red Hat Discovery 2
Default version status: affected
1784821670 to < *unaffected
Red Hat Red Hat OpenShift Container Platform 4.21
Default version status: affected
1791981285 to < *unaffected
Red Hat Migration Toolkit for Applications 8
Default version status: affected
Red Hat Migration Toolkit for Virtualization
Default version status: affected
Red Hat Migration Toolkit for Virtualization
Default version status: affected
Red Hat OpenShift Service Mesh 3
Default version status: unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Default version status: unaffected
Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
Default version status: unaffected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: unaffected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: unaffected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: unaffected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform 2
Default version status: unaffected
Red Hat Red Hat Ansible Automation Platform Ansible Core 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform Ansible Core 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform Ansible Core 2
Default version status: affected
Red Hat Red Hat Ansible Automation Platform Ansible Core 2
Default version status: affected
Red Hat Self-service automation portal 2
Default version status: affected
Red Hat Service Telemetry Framework 1.5
Default version status: unaffected
Red Hat Service Telemetry Framework 1.5
Default version status: unaffected
References
- https://access.redhat.com/errata/RHSA-2026:42078 ↗
- https://access.redhat.com/errata/RHSA-2026:42079 ↗
- https://access.redhat.com/errata/RHSA-2026:42080 ↗
- https://access.redhat.com/errata/RHSA-2026:46836 ↗
- https://access.redhat.com/errata/RHSA-2026:50340 ↗
- https://access.redhat.com/errata/RHSA-2026:50344 ↗
- https://access.redhat.com/errata/RHSA-2026:50357 ↗
- https://access.redhat.com/errata/RHSA-2026:50479 ↗
- https://access.redhat.com/errata/RHSA-2026:57148 ↗
- https://access.redhat.com/errata/RHSA-2026:57149 ↗
- https://access.redhat.com/errata/RHSA-2026:63385 ↗
- https://access.redhat.com/errata/RHSA-2026:63386 ↗
- https://access.redhat.com/errata/RHSA-2026:63387 ↗
- https://access.redhat.com/errata/RHSA-2026:66248 ↗
- https://access.redhat.com/errata/RHSA-2026:67465 ↗
- https://access.redhat.com/errata/RHSA-2026:67466 ↗
- https://access.redhat.com/errata/RHSA-2026:67467 ↗
- https://access.redhat.com/errata/RHSA-2026:83703 ↗
- https://access.redhat.com/errata/RHSA-2026:87124 ↗
- https://access.redhat.com/security/cve/CVE-2026-11332 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2485379 ↗
- https://github.com/ansible/ansible ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json ↗