CVE-2026-11332
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
- CVSS 3.1
- 7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-25)
- CWE
- CWE-88
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w8p5-mx5w-cpqj | PyPI | ansible-core | <2.16.19rc1 | 2.16.19rc1 |
| GHSA-w8p5-mx5w-cpqj | PyPI | ansible-core | >=2.17.0b1 <2.18.18rc1 | 2.18.18rc1 |
| GHSA-w8p5-mx5w-cpqj | PyPI | ansible-core | >=2.19.0b1 <2.19.11rc1 | 2.19.11rc1 |
| GHSA-w8p5-mx5w-cpqj | PyPI | ansible-core | >=2.20.0b1 <2.20.7rc1 | 2.20.7rc1 |
| GHSA-w8p5-mx5w-cpqj | PyPI | ansible-core | >=2.21.0b1 <2.21.1rc1 | 2.21.1rc1 |
| PYSEC-2026-3458 | PyPI | ansible-core | <2.16.19rc1 >=2.17.0b1 <2.18.18rc1 >=2.19.0b1 <2.19.11rc1 >=2.20.0b1 <2.20.7rc1 >=2.21.0b1 <2.21.1rc1 | 2.16.19rc1, 2.18.18rc1, 2.19.11rc1, 2.20.7rc1, 2.21.1rc1 |