CVE-2026-11332

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

Conditions for Exploitation: Successful exploitation requires user interaction, specifically tricking a victim into installing a maliciously crafted Ansible role (or a role with a malicious dependency) using the ansible-galaxy role install command.

Broad Impact: While user interaction is required, the potential impact is highly severe. Successfully injecting the malicious arguments allows a remote attacker to achieve arbitrary code execution on the machine running the Ansible command, leading to a full compromise of the user's environment and system integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.