ansible-core: malicious Galaxy role injects git flags to run code on the machine installing it

Impact

ansible-galaxy role install reads dependency specifications from a role's meta/requirements.yml, and improper neutralization of argument delimiters lets a role author inject arbitrary git configuration flags through the src field, executing code on the machine doing the install. That machine is usually the provisioning host or CI runner that holds SSH keys and root over every node in the fleet, so the payoff is not one workstation but the automation credentials for the whole cluster. Exploitation requires an operator to install the untrusted role, and transitive dependencies make that easy to do without reading what you pulled.

Who can reach it

An operator or CI job running ansible-galaxy role install against a role the attacker authored or can modify. User interaction required; no authentication to the target and no network-facing path.

What to do

Red Hat has shipped ansible-core errata across Ansible Automation Platform 2.5–2.7 and RHEL 10 (RHSA-2026:42078, 42079, 42080, 46836, 50340) — update the ansible-core package on control nodes, bastions and CI images. It is a package update on the tooling host: nothing to drain, nothing to reboot, no effect on running workloads. Until it is rolled out, pin role sources to repositories you control and review meta/requirements.yml before installing third-party roles.

References

Related entries

• ansible-core: git argument injection in ansible-galaxy collection install yields command executionCVE-2026-16493 · ansible-core (ansible-galaxy collection install, git source URL handling)High
• MUNGE (munged credential daemon): This is the root of trust under Slurm. A crafted message with an oversizedCVE-2026-25506 · MUNGE (munged credential daemon)High
• VMware Avi Load Balancer: local user can escalate to root on the applianceCVE-2026-47868 · VMware Avi Load Balancer (Controller and Service Engine appliance)High
• Linuxfabrik monitoring plugins: pipe injection in shell_exec escalates a check account to rootCVE-2026-55426 · Linuxfabrik Monitoring Plugins / linuxfabrik-lib (lib.shell.shell_exec)High
• Apache Storm worker-launcher: TOCTOU on the command file gives a tenant root-equivalent container launchCVE-2026-82430 · Apache Storm worker-launcher (setuid-root Docker/OCI worker launch)High
• SonicWall SMA1000: authenticated admin can inject OS commands through the management consoleCVE-2026-83549 · SonicWall SMA1000 appliance (Appliance Management Console, OS command injection)High