CVE-2026-12398: Galaxy_ng: shell injection in legacy role import via unsanitized git ref names
A command injection vulnerability was found in galaxyng. The dogitcheckout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXYENABLELEGACYROLES is set to True, which is not the default configuration.
Other sources
A command injection vulnerability was found in galaxyng's legacy role import functionality. The dogitcheckout() function in galaxyng/app/api/v1/tasks.py constructs shell commands via f-string interpolation using unsanitized git ref names (branch/tag names from the githubreference parameter) and executes them with subprocess.run(cmd, shell=True). An authenticated user who controls a git repository can create a branch or tag with shell metacharacters (such as ;, |, $(), &, >) in the name, and when the legacy role import processes this reference, the shell metacharacters are interpreted by the shell, achieving remote code execution on the pulp worker process.
The vulnerability requires GALAXYENABLELEGACYROLES to be set to True, which is NOT the default configuration in any shipped version of Red Hat Ansible Automation Platform (2.4 through 2.6). When this setting is False (the default), the v1 API routes are not registered in Django URL routing and the vulnerable endpoint returns 404. However, any deployment that explicitly enables legacy role support (e.g., community-galaxy profile or custom configurations) is exposed to authenticated RCE.
A secondary vector exists via the alternatecloneurl parameter, which accepts arbitrary URLs with no validation (enabling SSRF), though the git clone operation on that path uses shell=False, preventing shell injection via that specific parameter.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure GALAXY_ENABLE_LEGACY_ROLES is set to False so that the legacy role import API (v1) routes are not registered in Django URL routing (vulnerable endpoint returns 404 by default when the setting is False).
galaxy_ng GALAXY_ENABLE_LEGACY_ROLES = False
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12398?
CVE-2026-12398 has a severity rating of high, with a CVSS score of 7.5.
How do I fix CVE-2026-12398?
To fix CVE-2026-12398, ensure that input for git repository references is properly sanitized before being processed.
What systems are affected by CVE-2026-12398?
CVE-2026-12398 affects the Galaxy_ng software and Red Hat Ansible Automation Platform.
What is the risk associated with CVE-2026-12398?
The risk associated with CVE-2026-12398 is rated at 70, indicating a significant potential impact.
Can CVE-2026-12398 lead to remote code execution?
Yes, CVE-2026-12398 can lead to remote code execution due to command injection vulnerabilities.