CVE-2026-11332
High · 7.8CVSS
7.8
EPSS
0.2%
Published
Jun 5, 2026
CISA due date
—
The record
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Leap 16.0 | ansible-core | 0 | 2.18.3-160000.3.1 |
| openSUSE:Tumbleweed | ansible-core | 0 | 2.21.0-3.1 |
| openSUSE:Tumbleweed | ansible-core-2.18 | 0 | 2.18.18-1.1 |
| openSUSE:Tumbleweed | ansible-core-2.19 | 0 | 2.19.11-1.1 |
| openSUSE:Tumbleweed | ansible-core-2.20 | 0 | 2.20.7-1.1 |
Related vulnerabilities
- CVE-2024-11079 A flaw was found in Ansible-Core. Also affects ansible-core
- CVE-2024-9902 A flaw was found in Ansible. Also affects ansible-core
- CVE-2024-8775 A flaw was found in Ansible, where sensitive information stored in Ansible Vault files… Also affects ansible-core
- CVE-2024-0690 An information disclosure flaw was found in ansible-core due to a failure to respect the… Also affects ansible-core
- CVE-2023-5115 An absolute path traversal attack exists in the Ansible automation platform. Also affects ansible-core
- CVE-2023-5764 A template injection flaw was found in Ansible where a user's controller internal… Also affects ansible-core
- CVE-2026-112944 launch-editor allows users to open files with line numbers in editor from Node.js. CWE-88
- CVE-2026-112900 Pillow is a Python imaging library. CWE-88