galaxy_ng: namespace avatar URL is fetched unchecked, giving SSRF into internal and metadata endpoints

Impact

A user with namespace management permissions can point a namespace avatar at any address, and a background worker fetches it with no destination check. That reaches loopback, internal networks and cloud instance metadata endpoints from inside the content server's trust zone, which is how an internal-only admin API or a metadata-issued cloud credential gets exposed to someone who only had rights to manage a namespace. It also works as an internal port and host scanner, since responses reveal what is reachable. Separately, the HTTP client has no overall timeout, so pointing a namespace at a deliberately slow endpoint pins background workers and stalls content processing for everyone using the hub. Where this server is the source of automation content for a fleet, both outcomes land on shared infrastructure rather than one user's namespace.

Who can reach it

An authenticated user holding namespace management permissions on the Galaxy/Automation Hub instance. No administrator role and no network position beyond normal user access to the web interface are required; the fetch is performed by the server, so the attacker never needs a route to the internal target themselves.

What to do

Track Red Hat's advisory for the Ansible Automation Platform 2 errata that ships the fixed galaxy_ng - the record here does not name a fixed version or errata number, so do not assume one is out yet. Applying it is a package update and a restart of the API and worker processes; no node drain is involved. Meanwhile, reduce who holds namespace management permissions, and if your environment allows it, put egress controls in front of the server so it cannot reach loopback, RFC1918 ranges or the cloud metadata address.

References

Related entries

• Vertiv Avocent UMG-4000 universal management gateway: An authenticated admin can plant a maliciously named fileCVE-2019-9508 · Vertiv Avocent UMG-4000 universal management gatewayMedium
• Slurm (openSUSE slurm-testsuite packaging): The openSUSE slurm testsuite package ships files with permissive defaultCVE-2022-31251 · Slurm (openSUSE slurm-testsuite packaging)Medium
• Cisco UCS Central Software (weak backup encryption): Weak encryption on full-state and configuration backups meansCVE-2024-20280 · Cisco UCS Central Software (weak backup encryption)Medium
• Dell OpenManage Enterprise (credential disclosure): A low-privileged local user obtains stored credentials from OMECVE-2024-28961 · Dell OpenManage Enterprise (credential disclosure)Medium
• CZ.NIC BIRD Internet Routing Daemon (BGP AS_PATH mask matching): Stack-based buffer overflow in BIRD's AS_PATH maskCVE-2026-49943 · CZ.NIC BIRD Internet Routing Daemon (BGP AS_PATH mask matching)Medium
• Prometheus (exporter-toolkit): Poisoning the built-in auth cache bypasses basic-auth on exportersCVE-2022-46146 · Prometheus (exporter-toolkit)Medium