CVE-2026-11332: Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
Other sources
A flaw was found in ansible-core's ansible-galaxy command. When installing a role, ansible-galaxy processes a meta/requirements.yml file that lists role dependencies. The src and name fields from this file are passed as arguments to git clone via Python's Popen without a -- separator to delimit options from positional arguments. A malicious role author can craft a dependency entry where the src field contains a git configuration flag (e.g., -ccore.sshCommand=sh -c "maliciouscommand") and the name field provides a valid repository URL. This results in arbitrary code execution on the system of any user who installs the role. The fix is to insert -- before the positional arguments in the git clone command list.
— Red Hat
Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.17.11-2 - Upgrade
Upgrade
debian/ansibleto a version that resolves this vulnerability.Fixed in 5.4.0-1 - Upgrade
Upgrade
debian/ansible-coreto a version that resolves this vulnerability.Fixed in 2.19.11-0+deb13u1 - Upgrade
Upgrade
debian/ansible-coreto a version that resolves this vulnerability.Fixed in 2.21.1~rc1-1 - Upgrade
Upgrade
debian/ansibleto a version that resolves this vulnerability.Fixed in 7.7.0+dfsg-3+deb12u1Fixed in 12.0.0+dfsg-0+deb13u1Fixed in 14.0.0+dfsg-1Fixed in 14.4.0+dfsg-1 - Upgrade
Upgrade
debian/ansible-coreto a version that resolves this vulnerability.Fixed in 2.19.11-0+deb13u1Fixed in 2.22.0~beta2-1 - Configuration
Update ansible-galaxy role install behavior so that when building the git clone command list, it inserts the "--" separator before the positional arguments; this prevents src from injecting git configuration flags (e.g., via meta/requirements.yml src).
ansible-galaxy (ansible-core) / git clone invoked by role install git clone argument list (add -- separator) = -- inserted before positional arguments
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11332?
CVE-2026-11332 has a high severity rating of 7.8.
How do I fix CVE-2026-11332?
To fix CVE-2026-11332, upgrade to the latest version of ansible-core where the vulnerability is patched.
What type of vulnerability is CVE-2026-11332?
CVE-2026-11332 is an argument injection vulnerability that allows arbitrary code execution.
What software is affected by CVE-2026-11332?
CVE-2026-11332 affects the pypi/ansible-core package.
What can an attacker do with CVE-2026-11332?
An attacker can exploit CVE-2026-11332 to inject arbitrary git configuration flags and execute malicious code.