CVE-2026-12398: galaxy_ng Command Injection RCE Flaw

CVE-2026-12398 Overview

CVE-2026-12398 is a command injection vulnerability in galaxy_ng, the Ansible Galaxy NG content management server. The flaw resides in the do_git_checkout() function within the legacy role import API (v1). Unsanitized git reference names (branches or tags) are interpolated directly into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can craft a branch or tag containing shell metacharacters to achieve remote code execution on the Pulp worker process. The vulnerable endpoint is reachable only when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.

Critical Impact
Authenticated attackers can execute arbitrary commands on the Pulp worker host, leading to full compromise of the content management infrastructure.

Affected Products

galaxy_ng (Ansible Galaxy NG) — instances with GALAXY_ENABLE_LEGACY_ROLES=True
Red Hat Ansible Automation Platform deployments incorporating affected galaxy_ng versions
Pulp worker components processing legacy role imports

Discovery Timeline

2026-06-16 - CVE-2026-12398 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-12398

Vulnerability Analysis

The vulnerability is classified under [CWE-78] — Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). The legacy role import workflow accepts a git repository URL and reference name from an authenticated user. The do_git_checkout() function constructs a shell command string that includes the user-supplied ref name. Because the command is dispatched through subprocess.run() with shell=True, the shell interprets metacharacters such as ;, |, &&, $(), and backticks. An attacker who controls a git repository can push a branch or tag whose name embeds arbitrary shell syntax. When the Pulp worker checks out that ref during import, the embedded commands execute under the worker's user context.

Root Cause

The root cause is the combination of two unsafe patterns: string interpolation of untrusted input into a command line, and invocation of that command line through a shell interpreter. Git permits reference names containing characters that the shell treats as control operators. The do_git_checkout() implementation does not validate, escape, or quote the ref name before assembling the command. A safer pattern would pass arguments as a list with shell=False, or validate ref names against git check-ref-format rules.

Attack Vector

Exploitation requires an authenticated account with permission to submit legacy role imports, and an instance configured with GALAXY_ENABLE_LEGACY_ROLES=True. The attacker hosts a public or attacker-controlled git repository and creates a branch or tag whose name contains shell metacharacters and a payload command. The attacker then submits an import request referencing that repository and ref. When the Pulp worker invokes do_git_checkout(), the embedded payload executes on the worker host with the privileges of the Pulp service account. From there, attackers can pivot, read secrets, or tamper with stored content.

No verified exploitation code is publicly available. For technical details refer to the Red Hat CVE-2026-12398 Advisory and the Red Hat Bug Report #2489180.

Detection Methods for CVE-2026-12398

Indicators of Compromise

Unexpected child processes spawned by the Pulp worker process, particularly shells (/bin/sh, /bin/bash), curl, wget, or interpreters such as python and perl.
Legacy role import requests referencing external git repositories with unusual ref names containing characters such as ;, |, $(, or backticks.
Outbound network connections from Pulp worker hosts to unfamiliar destinations following an import event.

Detection Strategies

Inspect galaxy_ng and Pulp worker logs for legacy role import API (v1) calls and correlate them with process execution telemetry on the worker host.
Hunt for git checkout or git clone invocations where arguments contain shell metacharacters, and flag any subsequent non-git child processes spawned in the same session.
Audit configuration management for the presence of GALAXY_ENABLE_LEGACY_ROLES=True, which exposes the vulnerable code path.

Monitoring Recommendations

Enable process creation auditing on Pulp worker hosts and forward events to a centralized logging or SIEM platform.
Alert on Pulp worker processes that spawn interactive shells, network utilities, or write to unexpected filesystem locations.
Track authentication events for accounts permitted to submit role imports and review their activity for anomalies.

How to Mitigate CVE-2026-12398

Immediate Actions Required

Set GALAXY_ENABLE_LEGACY_ROLES to False unless legacy role imports are an operational requirement. This removes the vulnerable code path from reachable surface.
Restrict accounts authorized to submit role imports to trusted users only, and review existing user permissions.
Apply vendor-supplied patches for galaxy_ng as soon as they become available from your distribution channel.

Patch Information

Consult the Red Hat CVE-2026-12398 Advisory for the authoritative list of fixed package versions across Red Hat Ansible Automation Platform components. Upstream remediation in galaxy_ng switches argument handling for subprocess.run() to a list form without shell=True and adds validation of git ref names.

Workarounds

Disable the legacy role import API by ensuring GALAXY_ENABLE_LEGACY_ROLES=False in the application configuration.
Place the galaxy_ng instance behind authentication controls that limit access to vetted operators only, reducing the population of users able to reach the vulnerable endpoint.
Use egress filtering on Pulp worker hosts to limit outbound connectivity to known content sources, constraining post-exploitation activity.

bash

# Configuration example: disable the vulnerable legacy role import endpoint
# In galaxy_ng settings (e.g., /etc/pulp/settings.py)
GALAXY_ENABLE_LEGACY_ROLES = False