Description
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 10 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 for RHEL 10 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 for RHEL 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 10 | — | — |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | — | — |
| Red Hat | Red Hat Satellite 6.17 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.18 for RHEL 9 | — | — |
| Red Hat | Red Hat Satellite 6.19 for RHEL 9 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.5 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.6 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2.7 | — | — |
| Red Hat | Red Hat Discovery 2 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.19 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.20 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.21 | — | — |
| Red Hat | Migration Toolkit for Applications 8 | — | — |
| Red Hat | Migration Toolkit for Virtualization | — | — |
| Red Hat | OpenShift Service Mesh 3 | — | — |
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | — | — |
| Red Hat | Red Hat Ansible Automation Platform 2 | — | — |
| Red Hat | Red Hat Ansible Automation Platform Ansible Core 2 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 5 | — | — |
| Red Hat | Self-service automation portal 2 | — | — |
| Red Hat | Service Telemetry Framework 1.5 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ansible | 5.4.0-1 | — |
| Debian 14 | ansible-core | 2.21.1~rc1-1 | — |
| Debian 13 | ansible | 5.4.0-1 | — |
| Debian 13 | ansible-core | 2.19.11-0+deb13u1 | — |
| Debian 12 | ansible | 5.4.0-1 | — |
| Debian 12 | ansible-core | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ansible +1 | No fix yet | — |
| Ubuntu 26.04 LTS | ansible +1 | No fix yet | — |
| Ubuntu 25.10 | ansible +1 | No fix yet | — |
| Ubuntu 24.04 LTS | ansible +1 | No fix yet | — |
| Ubuntu 22.04 LTS | ansible-core | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 20.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 18.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 16.04 LTS | ansible | No fix yet | — |
| Ubuntu Pro 14.04 LTS | ansible | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | ansible-core +1 | 1:2.16.16-2.el10_2.1 | RHSA-2026:57148 |
| RHEL 9 | ansible-core +1 | 1:2.14.18-3.el9_8.1 | RHSA-2026:57149 |
| RHEL 8 | ansible-core +1 | 2.16.3-4.el8_10 | RHSA-2026:66248 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | rubygem-jwt | 2.10.3-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite Maintenance 6 | ansible-core | 1:2.16.19-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite Capsule 6 | ansible-core +1 | 1:2.16.19-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite Capsule 6 | openvox-server | 8.15.2-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite Capsule 6 | pulpcore-obsolete-packages | 1.3.1-5.el9pc | RHSA-2026:63386 |
| Red Hat Satellite Capsule 6 | python-aiohttp +2 | 3.14.3-1.el9pc | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite Capsule 6 | python3.12-gitpython | 3.1.59-1.el9pc | RHSA-2026:63385 |
| Red Hat Satellite Capsule 6 | python3.12-pulpcore | 3.73.30-3.el9pc | RHSA-2026:63386 |
| Red Hat Satellite Capsule 6 | rubygem-jwt | 2.10.3-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite 6 | ansible-core +1 | 1:2.16.19-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite 6 | openvox-server | 8.15.2-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite 6 | pulpcore-obsolete-packages | 1.3.1-5.el9pc | RHSA-2026:63386 |
| Red Hat Satellite 6 | python-aiohttp +2 | 3.14.3-1.el9pc | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| Red Hat Satellite 6 | python3.12-gitpython | 3.1.59-1.el9pc | RHSA-2026:63385 |
| Red Hat Satellite 6 | python3.12-pulpcore | 3.73.30-3.el9pc | RHSA-2026:63386 |
| Red Hat Satellite 6 | rubygem-jwt | 2.10.3-1.el9sat | RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385 |
| RHEL 10.0 EUS | ansible-core +1 | 1:2.16.14-1.el10_0.1 | RHSA-2026:67465 |
| RHEL 9.6 EUS | ansible-core +1 | 1:2.14.18-1.el9_6.1 | RHSA-2026:67466 |
| RHEL 9.4 E4S | ansible-core +1 | 1:2.14.14-1.el9_4.1 | RHSA-2026:67467 |
| Red Hat Ansible Automation Platform Inside 2 | ansible-core | 1:2.16.19-1.el8ap | RHSA-2026:42080, RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42080, RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | ansible-core | 1:2.16.19-1.el8ap | RHSA-2026:42080, RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.6.30-2.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-urllib3 | 2.7.0-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | ansible-core +1 | 1:2.16.19-1.el8ap | RHSA-2026:42080, RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.6.30-2.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-eda-controller +4 | 1.1.20-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-gateway +2 | 2.5.20260715-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy +1 | 2.6.17-1.el9ap | RHSA-2026:42079 |
| Red Hat Ansible Automation Platform 2 | automation-hub +1 | 4.10.16-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.11-1.el9ap | RHSA-2026:42079 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.50-1.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulp-ansible | 1:0.25.6-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulp-container | 2.19.12-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pulpcore | 3.49.63-2.el8ap | RHSA-2026:42079, RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pyjwt +1 | 2.13.0-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-pysequoia | 0.1.34-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | python3.12-urllib3 | 2.7.0-1.el8ap | RHSA-2026:42078 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.6.6-1.el8ap | RHSA-2026:42080, RHSA-2026:42079, RHSA-2026:42078 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | ansible-core +1 | 1:2.16.16-2.el10_2.1 | ALSA-2026:57148 |
| AlmaLinux 9 | ansible-core +1 | 1:2.14.18-3.el9_8.1 | ALSA-2026:57149 |
| AlmaLinux 8 | ansible-core +1 | 2.16.3-4.el8_10 | ALSA-2026:66248 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | ansible-core | 1:2.16.16-2.el10_2.1 | RLSA-2026:57148 |
| Rocky Linux 9 | ansible-core | 1:2.14.18-3.el9_8.1 | RLSA-2026:57149 |
| Rocky Linux 8 | ansible-core | 2.16.3-4.el8_10 | RLSA-2026:66248 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | ansible-core | 2.18.3-150400.9.14.1 | SUSE-SU-2026:4154-1, SUSE-SU-2026:2680-1 |
| SLES 15 SP6 | ansible-core | 2.18.3-150400.9.17.1 | SUSE-SU-2026:4154-1 |
| SLES 15 SP5 | ansible-core | 2.18.3-150400.9.17.1 | SUSE-SU-2026:4154-1 |
| SLES 15 SP4 | ansible-core | 2.18.3-150400.9.17.1 | SUSE-SU-2026:4154-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | ansible-core | 2.18.3-160000.3.1 | SUSE-SU-2026:23724-1, SUSE-SU-2026:23704-1, SUSE-SU-2026:22171-1 |
| SLES for SAP 15 SP6 | ansible-core | 2.18.3-150400.9.17.1 | SUSE-SU-2026:4154-1 |
| SLES for SAP 15 SP5 | ansible-core | 2.18.3-150400.9.17.1 | SUSE-SU-2026:4154-1 |
| SLES for SAP 15 SP4 | ansible-core | 2.18.3-150400.9.17.1 | SUSE-SU-2026:4154-1 |
| SLES 16.0 | ansible-core | 2.18.3-160000.3.1 | SUSE-SU-2026:23724-1, SUSE-SU-2026:23704-1, SUSE-SU-2026:22171-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ansible-core | 2.21.0-3.1 | openSUSE-SU-2026:11007-1 |
| openSUSE Tumbleweed | ansible-core-2.18 | 2.18.18-1.1 | openSUSE-SU-2026:11062-1 |
| openSUSE Tumbleweed | ansible-core-2.19 | 2.19.11-1.1 | openSUSE-SU-2026:11063-1 |
| openSUSE Tumbleweed | ansible-core-2.20 | 2.20.7-1.1 | openSUSE-SU-2026:11064-1 |
| openSUSE Tumbleweed | ansible-core-2.21 | 2.21.6-1.1 | openSUSE-SU-2026:12451-1 |
| openSUSE Tumbleweed | molecule +3 | 26.8.0-1.1 | openSUSE-SU-2026:11840-1, openSUSE-SU-2026:11509-1, openSUSE-SU-2026:11507-1 |
| openSUSE Leap 16.0 | ansible-core | 2.18.3-160000.3.1 | openSUSE-SU-2026:21828-1, openSUSE-SU-2026:21097-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | ansible-core +1 | 2.15.3-1.amzn2023.0.12 | ALAS2023-2026-1849 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | ansible | No fix yet | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | ansible-core +1 | 1:2.16.16-2.0.1.el10_2.1 | ELSA-2026-57148 |
| Oracle Linux 9 | ansible-core +1 | 1:2.14.18-3.el9_8.1 | ELSA-2026-57149 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ansible-core | < 2.16.19rc1 | 2.16.19rc1 | GHSA-w8p5-mx5w-cpqj |
| PyPI | ansible-core | >= 2.17.0b1, < 2.18.18rc1 | 2.18.18rc1 | GHSA-w8p5-mx5w-cpqj |
| PyPI | ansible-core | >= 2.19.0b1, < 2.19.11rc1 | 2.19.11rc1 | GHSA-w8p5-mx5w-cpqj |
| PyPI | ansible-core | >= 2.20.0b1, < 2.20.7rc1 | 2.20.7rc1 | GHSA-w8p5-mx5w-cpqj |
| PyPI | ansible-core | >= 2.21.0b1, < 2.21.1rc1 | 2.21.1rc1 | GHSA-w8p5-mx5w-cpqj |
| PyPI | ansible-core | < 2.16.19rc1 · >= 2.17.0b1, < 2.18.18rc1 · >= 2.19.0b1, < 2.19.11rc1 · >= 2.20.0b1, < 2.20.7rc1 · >= 2.21.0b1, < 2.21.1rc1 | 2.16.19rc1, 2.18.18rc1, 2.19.11rc1, 2.20.7rc1, 2.21.1rc1 | PYSEC-2026-3458 |
Advisories 40
- WID-SEC-2026-4111 Red Hat Ansible Automation Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- openSUSE-SU-2026:12451-1 ansible-core-2.21-2.21.6-1.1 on GA media SUSE / openSUSE Security Updates · Nov 7, 2026
- WID-SEC-2026-2657 Red Hat Ansible Automation Platform (ansible-core): Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 3, 2026
- ALSA-2026:57149 Important: ansible-core security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:57148 Important: ansible-core security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:66248 Important: ansible-core security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-4084 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 20, 2026
- RHSA-2026:63387 Red Hat Security Advisory: Satellite 6.17.11 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:63386 Red Hat Security Advisory: Satellite 6.18.9 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:63385 Red Hat Security Advisory: Satellite 6.19.4 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:42080 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.7 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:42079 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:42078 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:67466 Red Hat Security Advisory: ansible-core security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:67467 Red Hat Security Advisory: ansible-core security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:67465 Red Hat Security Advisory: ansible-core security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:66248 Red Hat Security Advisory: ansible-core security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:57149 Red Hat Security Advisory: ansible-core security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:57148 Red Hat Security Advisory: ansible-core security update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- SUSE-SU-2026:23724-1 Security update for ansible-core SUSE / openSUSE Security Updates · Sep 29, 2026
- SUSE-SU-2026:23704-1 Security update for ansible-core SUSE / openSUSE Security Updates · Sep 29, 2026
- openSUSE-SU-2026:11840-1 python3-pytest-ansible-26.8.0-1.1 on GA media SUSE / openSUSE Security Updates · Sep 22, 2026
- SUSE-SU-2026:4154-1 Security update for ansible-core SUSE / openSUSE Security Updates · Sep 15, 2026
- openSUSE-SU-2026:21828-1 Security update for ansible-core SUSE / openSUSE Security Updates · Sep 12, 2026
- RLSA-2026:66248 Important: ansible-core security update Rocky Linux Security Advisories · Sep 11, 2026
- RLSA-2026:57149 Important: ansible-core security update Rocky Linux Security Advisories · Aug 20, 2026
- RLSA-2026:57148 Important: ansible-core security update Rocky Linux Security Advisories · Aug 20, 2026
- ELSA-2026-57148 Important: ansible-core security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Aug 20, 2026
- ELSA-2026-57149 Important: ansible-core security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 19, 2026
- openSUSE-SU-2026:11507-1 molecule-26.8.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 14, 2026
- openSUSE-SU-2026:11509-1 python3-ansible-compat-26.8.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 14, 2026
- openSUSE-SU-2026:11503-1 ansible-lint-26.8.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 14, 2026
- openSUSE-SU-2026:21097-1 Security update for ansible-core SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:2680-1 Security update for ansible-core SUSE / openSUSE Security Updates · Jun 30, 2026
- SUSE-SU-2026:22171-1 Security update for ansible-core SUSE / openSUSE Security Updates · Jun 24, 2026
- ALAS2023-2026-1849 Important: ansible-core security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 22, 2026
- openSUSE-SU-2026:11062-1 ansible-core-2.18-2.18.18-1.1 on GA media SUSE / openSUSE Security Updates · Jun 20, 2026
- openSUSE-SU-2026:11064-1 ansible-core-2.20-2.20.7-1.1 on GA media SUSE / openSUSE Security Updates · Jun 20, 2026
- openSUSE-SU-2026:11063-1 ansible-core-2.19-2.19.11-1.1 on GA media SUSE / openSUSE Security Updates · Jun 20, 2026
- openSUSE-SU-2026:11007-1 ansible-core-2.21.0-3.1 on GA media SUSE / openSUSE Security Updates · Jun 13, 2026
References
- RHSA-2026:42078 vendor-advisory
- RHSA-2026:42079 vendor-advisory
- RHSA-2026:42080 vendor-advisory
- RHSA-2026:46836 vendor-advisory
- RHSA-2026:50340 vendor-advisory
- RHSA-2026:50344 vendor-advisory
- RHSA-2026:50357 vendor-advisory
- RHSA-2026:50479 vendor-advisory
- RHSA-2026:57148 vendor-advisory
- RHSA-2026:57149 vendor-advisory
- RHSA-2026:63385 vendor-advisory
- RHSA-2026:63386 vendor-advisory
- RHSA-2026:63387 vendor-advisory
- RHSA-2026:66248 vendor-advisory
- RHSA-2026:67465 vendor-advisory
- RHSA-2026:67466 vendor-advisory
- RHSA-2026:67467 vendor-advisory
- RHSA-2026:83703 vendor-advisory
- RHSA-2026:87124 vendor-advisory
- RHSA-2026:92281 vendor-advisory
- RHSA-2026:92284 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2026-11332 vdb-entry
- RHBZ#2485379 issue-tracking
- https://github.com/ansible/ansible