Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 1 vendor · 2 advisories

CVE-2026-11332

argument injection in ansible-galaxy role install leads to arbitrary code execution

CVE-2026-11332: argument injection in ansible-galaxy role install leads to arbitrary code execution. Not in the CISA KEV catalog.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

CVE-2026-11332 at a glance

CISA KEV
Not listed (catalog checked )
Highest advisory severity
High
CVSS base score
7.8 (Red Hat)
Weakness
CWE-88
Vendor advisories
2 from Red Hat
VulniPulse record
Published · Updated

Scores, vectors, weaknesses and fixed releases are quoted from vendor advisories that cover only CVE-2026-11332; bulletin-wide values are not repeated here.

Is CVE-2026-11332 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-11332 is not in the CISA KEV catalog (checked ) and no tracked advisory for it reports exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-11332?

  • Red Hat rates this important; a fix erratum may not be out yet — apply the RHSA as soon as it publishes. (Red Hat)

Vendor advisory comparison

Red Hat

2 advisories
  • Advisory severityHigh7.8

    High [CVE-2026-11332 +1] argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

    CVE-2026-16493Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    A flaw was found in ansible-core. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path. Red Hat has assessed this vulnerability as Important because it allows arbitrary command execution when a user installs a collection from a crafted git source. Users who install collections exclusively from Ansible Galaxy or Automation Hub (HTTPS sources) are not exposed to this specific flaw. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-88.…

    Affected products in this advisory
    • Red Hat Satellite 6.17 for RHEL 9
    • Red Hat Satellite 6.18 for RHEL 9
    • Red Hat Satellite 6.19 for RHEL 9
    • Red Hat Ansible Automation Platform 2

    4 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    • ansible-core-1:2.16.19-1.el9sat
    • pulpcore-obsolete-packages-0:1.3.1-5.el9pc
    • python3.12-pulpcore-0:3.73.30-3.el9pc
    • RHSA-2026:63387

    2 more entries in the full advisory.

    Mitigation guidance
    • The following practices would help for avoiding exposure and mitigate this flaw: 1. Do not install Ansible collections from untrusted or unverified git sources. Only install collections from trusted sources such as Ansible Galaxy (https://galaxy.ansible.com), Red Hat Automation Hub (https://console.redhat.com/ansible/automation-hub), or verified internal repositories using HTTPS URLs. 2. Carefully inspect any requirements.yml files before running 'ansible-galaxy collection install -r requirements.yml'. Verify that all collection sources use legitimate HTTPS URLs and do not contain git+ prefixed URIs with suspicious characters (especially values starting with '-'). 3. Ensure your system's git version is 2.12 or later, which disables the ext:: transport by default. While this does not fully prevent exploitation (the -ccore.sshCommand technique bypasses transport restrictions), it eliminates one of the exploitation vectors. 4. Restrict the GIT_ALLOW_PROTOCOL environment variable to only necessary protocols (e.g. https, ssh) and never include 'ext' unless absolutely required.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityHigh7.8

    High [CVE-2026-11332] argument injection in ansible-galaxy role install leads to arbitrary code execution

    CVE-2026-11332Source published

    argument injection in ansible-galaxy role install leads to arbitrary code execution. Red Hat rates this important (CVSS 7.8). Weakness: CWE-88. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released.

    Affected products in this advisory
    • Red Hat Advanced Cluster Management for Kubernetes 2
    • Red Hat Discovery 2
    • Red Hat Enterprise Linux 8
    • Red Hat Ansible Automation Platform 2.7 for RHEL 10

    14 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • Red Hat rates this important; a fix erratum may not be out yet — apply the RHSA as soon as it publishes.
    Full advisory and evidenceOpen source bulletin

Browse the latest tracked CVEs or the CVEs listed in CISA KEV.

Android app · Google Play

Monitor future Red Hat CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features