CVE-2026-11332 Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution
A malicious Ansible role can inject git flags via requirements.yml, leading to arbitrary code execution on the user's machine during installation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-11332?
CVE-2026-11332 is a high-severity command injection vulnerability in Red Hat Migration Toolkit for Applications 8, published on 5 Jun 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
Weakness: CWE-88
Which versions are affected by CVE-2026-11332?
11 open source packages ship an affected version, including ansible-core.
| Package | Affected | Fixed in |
|---|---|---|
ansible-core PyPI | All versions | 2.16.19rc1, 2.18.18rc1, 2.19.11rc1, 2.20.7rc1, 2.21.1rc1 |
ansible-core PyPI | All versions | 2.16.19rc1 |
ansible-core PyPI | All versions | 2.16.19rc1 |
ansible-core PyPI | From 2.17.0b1 | 2.18.18rc1 |
ansible-core PyPI | From 2.17.0b1 | 2.18.18rc1 |
ansible-core PyPI | From 2.19.0b1 | 2.19.11rc1 |
5 more packages
ansible-core PyPI | From 2.19.0b1 | 2.19.11rc1 |
ansible-core PyPI | From 2.20.0b1 | 2.20.7rc1 |
ansible-core PyPI | From 2.20.0b1 | 2.20.7rc1 |
ansible-core PyPI | From 2.21.0b1 | 2.21.1rc1 |
ansible-core PyPI | From 2.21.0b1 | 2.21.1rc1 |
Linux distribution packages (29)
ansible-core AlmaLinux:10 | All versions | 1:2.16.16-2.el10_2.1 |
ansible-test AlmaLinux:10 | All versions | 1:2.16.16-2.el10_2.1 |
ansible-core AlmaLinux:8 | All versions | 2.16.3-4.el8_10 |
ansible-test AlmaLinux:8 | All versions | 2.16.3-4.el8_10 |
ansible-core AlmaLinux:9 | All versions | 1:2.14.18-3.el9_8.1 |
ansible-test AlmaLinux:9 | All versions | 1:2.14.18-3.el9_8.1 |
ansible-core Red Hat:enterprise_linux:10.2 | All versions | 1:2.16.16-2.el10_2.1 |
ansible-test Red Hat:enterprise_linux:10.2 | All versions | 1:2.16.16-2.el10_2.1 |
ansible-core Red Hat:enterprise_linux:8::appstream | All versions | 0:2.16.3-4.el8_10 |
ansible-test Red Hat:enterprise_linux:8::appstream | All versions | 0:2.16.3-4.el8_10 |
ansible-core Red Hat:enterprise_linux:9::appstream | All versions | 1:2.14.18-3.el9_8.1 |
ansible-test Red Hat:enterprise_linux:9::appstream | All versions | 1:2.14.18-3.el9_8.1 |
ansible-core Red Hat:enterprise_linux_eus:10.0 | All versions | 1:2.16.14-1.el10_0.1 |
ansible-test Red Hat:enterprise_linux_eus:10.0 | All versions | 1:2.16.14-1.el10_0.1 |
ansible-core Red Hat:rhel_e4s:9.4::appstream | All versions | 1:2.14.14-1.el9_4.1 |
ansible-test Red Hat:rhel_e4s:9.4::appstream | All versions | 1:2.14.14-1.el9_4.1 |
ansible-core Red Hat:rhel_eus:9.6::appstream | All versions | 1:2.14.18-1.el9_6.1 |
ansible-test Red Hat:rhel_eus:9.6::appstream | All versions | 1:2.14.18-1.el9_6.1 |
ansible-core Rocky Linux:10 | All versions | 1:2.16.16-2.el10_2.1 |
ansible-core Rocky Linux:8 | All versions | 0:2.16.3-4.el8_10 |
ansible-core Rocky Linux:9 | All versions | 1:2.14.18-3.el9_8.1 |
ansible-core SUSE:Linux Enterprise Module for Package Hub 15 SP7 | All versions | 2.18.3-150400.9.14.1 |
ansible-core SUSE:Linux Enterprise Module for Systems Management 15 SP7 | All versions | 2.18.3-150400.9.14.1 |
ansible-core SUSE:Linux Enterprise Server 16.0 | All versions | 2.18.3-160000.3.1 |
ansible-core SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 2.18.3-160000.3.1 |
ansible-core openSUSE:Leap 16.0 | All versions | 2.18.3-160000.3.1 |
ansible-core openSUSE:Tumbleweed | All versions | 2.21.0-3.1 |
ansible-core-2.18 openSUSE:Tumbleweed | All versions | 2.18.18-1.1 |
ansible-core-2.19 openSUSE:Tumbleweed | All versions | 2.19.11-1.1 |
How do I fix CVE-2026-11332?
Upgrade ansible-core to a fixed version for your release line: 2.16.19rc1, 2.18.18rc1, 2.19.11rc1 or 2.20.7rc1.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-11332 being exploited?
There is no known exploitation of CVE-2026-11332 in the wild and no public exploit code.
Sources
Also known as ALSA-2026:57148, ALSA-2026:57149, ALSA-2026:66248, AZL-89402, CLSA-2026-1788175790, CLSA-2026-1788269423 and 24 more.