CVE-2026-79717: galaxy_ng Ansible SSRF Vulnerability

CVE-2026-79717 Overview

CVE-2026-79717 is a server-side request forgery (SSRF) vulnerability in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address. A background worker then fetches that URL without validating the destination, enabling requests to internal networks, loopback interfaces, and cloud instance metadata endpoints. The HTTP client is also configured without an overall timeout, so a slow or non-responsive target can pin worker threads and cause denial of service. The weakness is categorized under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can probe internal services, enumerate reachable IP addresses, access cloud metadata endpoints, and exhaust background workers to trigger denial of service.

Affected Products

galaxy_ng (Ansible Galaxy server plugin for Pulp)
Red Hat Ansible Automation Platform deployments that ship galaxy_ng
Private Automation Hub instances built on galaxy_ng

Discovery Timeline

2026-08-25 - CVE-2026-79717 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-79717

Vulnerability Analysis

The vulnerability resides in the namespace avatar handling logic. When a user with namespace management permissions configures a namespace, the application accepts a user-supplied URL for the avatar image. A background Pulp worker later fetches that URL to retrieve the avatar asset.

The fetch operation does not validate the destination address before issuing the request. The worker will resolve and connect to any host, including RFC1918 addresses, 127.0.0.0/8 loopback ranges, link-local ranges such as 169.254.169.254, and internal service endpoints. This allows an authenticated attacker to use the server as a proxy to probe internal infrastructure.

A second defect compounds the impact: the HTTP client used by the worker lacks an overall request timeout. A malicious or slow endpoint can hold a worker connection open indefinitely, exhausting the worker pool and blocking legitimate namespace processing.

Root Cause

The root cause is missing destination validation on user-controlled URLs combined with an unbounded HTTP client timeout. The application trusts the avatar URL field and delegates fetching to a background worker without applying an allowlist, DNS pinning, or address-family filtering.

Attack Vector

Exploitation requires network access to the galaxy_ng API and an authenticated account with namespace management privileges. The attacker sets a namespace avatar URL pointing at an internal target such as http://169.254.169.254/latest/meta-data/ on AWS, http://127.0.0.1:6379/ for a local Redis instance, or an internal service host. The background worker performs the fetch and behavioral differences in response timing, size, or errors reveal service presence. For denial of service, the attacker points the avatar URL at a slow-response endpoint to occupy workers.

No verified public exploit code is available at the time of publication. See the Red Hat CVE-2026-79717 advisory for technical details.

Detection Methods for CVE-2026-79717

Indicators of Compromise

Outbound HTTP requests from Pulp worker processes to RFC1918, loopback, or link-local addresses such as 169.254.169.254.
Namespace update events where the avatar_url field references internal hostnames, IP literals, or non-standard ports.
Sustained increases in Pulp worker task duration or worker pool saturation without corresponding legitimate workload.

Detection Strategies

Inspect galaxy_ng audit logs for namespace modification events and correlate the avatar_url value against an allowlist of expected external image hosts.
Monitor egress traffic from Pulp worker nodes and alert on connections to metadata service IPs, private ranges, or ports associated with internal services.
Instrument the background worker with structured logging that records the resolved destination address of each avatar fetch.

Monitoring Recommendations

Track background worker queue depth and per-task execution time to identify pinning caused by non-responsive avatar URLs.
Enable network flow logging on the subnet hosting Pulp workers and review flows destined for cloud metadata endpoints.
Alert on repeated avatar update operations from the same user account within short time windows.

How to Mitigate CVE-2026-79717

Immediate Actions Required

Apply the vendor-supplied patch for galaxy_ng once available from Red Hat or the upstream project. Track status via the Red Hat CVE-2026-79717 advisory.
Restrict namespace management permissions to a minimal set of trusted operators.
Block egress from Pulp worker hosts to cloud metadata endpoints and internal management networks at the network layer.

Patch Information

Refer to the Red Hat Bug Report #2523431 and the GitHub Ansible Galaxy Repository for patch availability and version guidance. Fixes are expected to add destination validation on avatar URLs and enforce an overall HTTP client timeout in the background worker.

Workarounds

Enforce an egress proxy or firewall policy that denies Pulp worker requests to private, loopback, and link-local IP ranges.
Configure cloud instance metadata service protections such as IMDSv2 with hop-limit restrictions on AWS to reduce metadata exposure.
Audit and revoke unnecessary namespace management roles until the patch is applied.
Deploy a reverse proxy in front of avatar fetches that validates and rewrites destination URLs before the worker connects.

bash

# Example iptables rule to block worker egress to AWS metadata service
iptables -A OUTPUT -m owner --uid-owner pulp \
  -d 169.254.169.254 -j REJECT