Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

Summary

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

Timeline

1. Jun 5, 2026, 8:21 AM UTCCVE published
2. Jun 5, 2026, 3:43 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 21, 2026, 6:59 PM UTCRecord last updated

Affected versions

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• ansible-core

  Version range not reported

• pulpcore-obsolete-packages

  Version range not reported

• python3.12-pulpcore

  Version range not reported

• ansible-core

  Version range not reported

• ansible-automation-platform-25/ee-minimal-rhel8

  Version range not reported

• ansible-automation-platform-25/ee-supported-rhel8

  Version range not reported

• ansible-automation-platform-25/lightspeed-rhel8

  Version range not reported

• ansible-automation-platform-25/ee-minimal-rhel9

  Version range not reported

• ansible-automation-platform-25/ee-supported-rhel9

  Version range not reported

• ansible-automation-platform-26/de-minimal-rhel9

  Version range not reported

• ansible-automation-platform-26/de-supported-rhel9

  Version range not reported

• ansible-automation-platform-26/eda-controller-rhel9

  Version range not reported

• ansible-automation-platform-26/lightspeed-rhel9

  Version range not reported

• ansible-automation-platform-27/de-minimal-rhel9

  Version range not reported

• ansible-automation-platform-27/de-supported-rhel9

  Version range not reported

• ansible-automation-platform-27/eda-controller-rhel9

  Version range not reported

• ansible-automation-platform-27/lightspeed-rhel9

  Version range not reported

• ansible-automation-platform-27/platform-resource-rhel9-operator

  Version range not reported

• discovery/discovery-server-rhel9

  Version range not reported

• openshift4/ose-ansible-rhel9-operator

  Version range not reported

• mta/mta-rhel9-operator

  Version range not reported

• migration-toolkit-virtualization/mtv-rhel9-operator

  Version range not reported

• mtv-candidate/mtv-rhel9-operator

  Version range not reported

• openshift-service-mesh/kiali-rhel9-operator

  Version range not reported

• rhacm2/volsync-operator-bundle

  Version range not reported

• rhacm2/volsync-rhel9

  Version range not reported

• ansible-automation-platform-24/hub-rhel8

  Version range not reported

• ansible-automation-platform-24/lightspeed-rhel8

  Version range not reported

• ansible-automation-platform-25/controller-rhel8-operator

  Version range not reported

• ansible-automation-platform-25/de-minimal-rhel8

  Version range not reported

• ansible-automation-platform-25/de-supported-rhel8

  Version range not reported

• ansible-automation-platform-25/eda-controller-rhel8

  Version range not reported

• ansible-automation-platform-25/eda-controller-rhel8-operator

  Version range not reported

• ansible-automation-platform-25/gateway-rhel8-operator

  Version range not reported

• ansible-automation-platform-25/hub-rhel8

  Version range not reported

• ansible-automation-platform-25/hub-rhel8-operator

  Version range not reported

• ansible-automation-platform-25/lightspeed-rhel8-operator

  Version range not reported

• ansible-automation-platform-25/platform-resource-rhel8-operator

  Version range not reported

• ansible-automation-platform-25/platform-resource-runner-rhel8

  Version range not reported

• ansible-automation-platform-26/controller-rhel9-operator

  Version range not reported

• ansible-automation-platform-26/eda-controller-rhel9-operator

  Version range not reported

• ansible-automation-platform-26/ee-minimal-rhel9

  Version range not reported

• ansible-automation-platform-26/ee-supported-rhel9

  Version range not reported

• ansible-automation-platform-26/gateway-rhel9-operator

  Version range not reported

• ansible-automation-platform-26/hub-rhel9

  Version range not reported

• ansible-automation-platform-26/hub-rhel9-operator

  Version range not reported

• ansible-automation-platform-26/lightspeed-rhel9-operator

  Version range not reported

• ansible-automation-platform-26/platform-resource-rhel9-operator

  Version range not reported

• ansible-automation-platform-26/platform-resource-runner-rhel9

  Version range not reported

• ansible-automation-platform-27/aap-cloud-billing-operator-rhel9

  Version range not reported

• ansible-automation-platform-27/controller-rhel9-operator

  Version range not reported

• ansible-automation-platform-27/eda-controller-rhel9-operator

  Version range not reported

• ansible-automation-platform-27/ee-minimal-rhel9

  Version range not reported

• ansible-automation-platform-27/ee-supported-rhel9

  Version range not reported

• ansible-automation-platform-27/gateway-rhel9-operator

  Version range not reported

• ansible-automation-platform-27/hub-rhel9

  Version range not reported

• ansible-automation-platform-27/hub-rhel9-operator

  Version range not reported

• ansible-automation-platform-27/lightspeed-rhel9-operator

  Version range not reported

• ansible-automation-platform-27/metrics-service-rhel9-operator

  Version range not reported

• ansible-automation-platform-27/platform-resource-runner-rhel9

  Version range not reported

• ansible-automation-platform-tech-preview/ansible-devspaces-rhel9

  Version range not reported

• ansible-automation-platform-tech-preview/metrics-service-rhel9-operator

  Version range not reported

• ansible-automation-platform/ee-minimal-rhel8

  Version range not reported

• ansible-automation-platform/ee-minimal-rhel9

  Version range not reported

• ansible-automation-platform-tech-preview/ee-minimal-rhel8

  Version range not reported

• ansible-automation-platform-tech-preview/ee-minimal-rhel9

  Version range not reported

• ansible-automation-platform/bootc-automation-portal-rhel9

  Version range not reported

• stf/service-telemetry-rhel9-operator

  Version range not reported

• stf/smart-gateway-rhel9-operator

  Version range not reported

• ansible-corePyPI

  fixed in 2.16.19rc1

• ansible-corePyPI

  From 2.17.0b1 · fixed in 2.18.18rc1

• ansible-corePyPI

  From 2.19.0b1 · fixed in 2.19.11rc1

• ansible-corePyPI

  From 2.20.0b1 · fixed in 2.20.7rc1

• ansible-corePyPI

  From 2.21.0b1 · fixed in 2.21.1rc1

• ansible-corePyPI

  fixed in 2.16.19rc1; From 2.17.0b1 · fixed in 2.18.18rc1; From 2.19.0b1 · fixed in 2.19.11rc1; From 2.20.0b1 · fixed in 2.20.7rc1; From 2.21.0b1 · fixed in 2.21.1rc1

References 22