CVE-2026-11332 Overview
A flaw was found in ansible-core that enables arbitrary code execution through malicious role dependencies. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters [CWE-88], a malicious role author can inject arbitrary git configuration flags through the src field. Users who install the crafted role via ansible-galaxy role install will execute attacker-controlled code on their local machine. The flaw affects automation workflows where roles are fetched from untrusted sources.
Critical Impact
Installing a malicious Ansible role triggers arbitrary code execution on the user's host with full compromise of confidentiality, integrity, and availability.
Affected Products
- ansible-core (upstream Ansible project)
- Red Hat Ansible Automation Platform distributions
- Any tooling that bundles or invokes ansible-galaxy role install
Discovery Timeline
- 2026-06-05 - CVE CVE-2026-11332 published to NVD
- 2026-06-05 - Last updated in NVD database
Technical Details for CVE-2026-11332
Vulnerability Analysis
The vulnerability resides in how ansible-galaxy parses the src field within a role's meta/requirements.yml file. When a role declares dependencies, the installer passes the src value into a git command without neutralizing argument delimiters. An attacker who authors a role can place git command-line flags inside the src string. Git then interprets the injected flags as configuration directives rather than as part of the repository URL. This category of issue is tracked as Argument Injection [CWE-88]. The attacker requires a target user to run ansible-galaxy role install against a role they control or that pulls in a malicious transitive dependency.
Root Cause
The root cause is improper neutralization of argument delimiters when constructing the git subprocess invocation. The src field is treated as a trusted URL string and is concatenated into the git command line. Git accepts options such as --upload-pack and --config that can execute arbitrary binaries. Without sanitization or use of the -- end-of-options separator, the boundary between flags and positional arguments collapses.
Attack Vector
Exploitation requires user interaction. The attacker publishes a role to Ansible Galaxy or any git source, embedding a crafted src entry in meta/requirements.yml. When the victim runs ansible-galaxy role install, the dependency resolver fetches and parses the requirements file. The injected git flag triggers code execution under the victim's user context. The attack vector is local because exploitation operates on the user's workstation or build host, but distribution of the malicious role can occur over any channel. See the Red Hat CVE-2026-11332 Advisory for upstream technical details.
Detection Methods for CVE-2026-11332
Indicators of Compromise
- Unexpected child processes of ansible-galaxy or git such as shells, interpreters, or network utilities.
- meta/requirements.yml files containing src values that begin with -- or include git flags like --upload-pack, --config, or --exec.
- New cron entries, SSH keys, or shell profile modifications appearing shortly after a role installation.
- Outbound network connections from developer or CI hosts immediately following an ansible-galaxy role install invocation.
Detection Strategies
- Inspect every meta/requirements.yml retrieved from external sources for src fields that contain whitespace, leading dashes, or shell metacharacters.
- Hunt for process trees where git-upload-pack, git-clone, or ansible-galaxy spawn non-git child processes.
- Audit Ansible Galaxy installation logs and CI build logs for warnings or unusual git configuration parameters.
Monitoring Recommendations
- Enable command-line auditing on developer workstations and CI runners that execute ansible-galaxy.
- Forward shell history and process telemetry from automation hosts to a centralized log platform for retrospective hunting.
- Alert when git is invoked with --upload-pack=, --config, or other executable-bearing options outside of approved tooling.
How to Mitigate CVE-2026-11332
Immediate Actions Required
- Apply the patched ansible-core release referenced in the Red Hat CVE-2026-11332 Advisory as soon as it is available for your distribution.
- Pause automated execution of ansible-galaxy role install against untrusted sources until packages are updated.
- Review recently installed roles and rotate credentials accessible from any host that ran an installation from an untrusted source.
Patch Information
Refer to the Red Hat CVE-2026-11332 Advisory and Red Hat Bug Report #2485379 for fixed package versions. Upstream tracking is available through the GitHub Ansible Project Repository. Update both interactive workstations and CI/CD images that bundle ansible-core.
Workarounds
- Install roles only from vetted, internally mirrored sources and pin them by commit hash.
- Validate meta/requirements.yml before installation, rejecting any src value that begins with - or contains git option syntax.
- Run ansible-galaxy role install inside an isolated, ephemeral container or sandbox to limit blast radius on compromise.
- Restrict outbound network access from CI runners that execute role installations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
