VDB
RHSA-2026:50340
RHSA-2026:50340
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/ansible-automation-platform-27/hub-rhel9@sha256:b5400bb64dad7ce8aeed803b420c405bfe55cef08a28b9ac27e6c553c1bdf139_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/controller-rhel9@sha256:49603d8eb1133ff25d77932418445b3399d56696b91575f404d54bd66f2abdf1_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/mcp-tools-rhel9@sha256:79d9bcdc9f2a45950eb3b511b7a3c2224592be0cf560af467887c70ca74a41ab_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/mcp-server-rhel9@sha256:470f289922f14644f0b9bda434d7001608818466703dab8de333bc02a4f79573_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/controller-rhel9-operator@sha256:5af18e0dfbddd146401125d1af25e02fbcd5c9c9c99f8b3463035ce8e8dfc88a_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/gateway-rhel9-operator@sha256:b2979d79d95d2777e16c605ad777bd36d119a035bf10a94e8819cb0909ca5626_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/hub-rhel9-operator@sha256:0cf7e473d3c463bf1498d2a1f3ba31c64085e06bd1dc0db844432c13325dcdc0_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/mcp-server-rhel9@sha256:d014d2eafa11bbff61ef871608ab3cd332602b9138e9505d40521a67a6162400_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/mcp-tools-rhel9@sha256:b0814ef140b9746de9c081bdb18067ea16de065ac2d7a984c2a9c59bb4357709_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/gateway-proxy-rhel9@sha256:6706769c9e9e74957c01991b8ebe5fbce625b39ba762af1ad9989f11df0b8cf6_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/metrics-service-rhel9-operator@sha256:72c11674295ce5a7daa2c63dc7d4a63654912a5131391ccb2827223e5957ea05_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9@sha256:0e5b8ea19aaf599851b6d3c33f157fed70d6889c21f3b7dda42cc0aaee45e40a_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9@sha256:fc4564a19e737e01f69a8ffc7f609cfc00cbe78ecbd0202e21580798e0fad5b0_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform/platform-operator-bundle@sha256:fa0004bd6ec92544414d42a881421a41d8679fa9676bea2d641c6d1c10cad8e1_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9@sha256:35caea9f2f5102fb4088201ba4a96a8c3eab4dfae0facf03ed2a58aeb0ce4549_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/gateway-rhel9@sha256:8471b0b7b66309f346fe83e0a05ce968dcb9b55c2510e1f269c05b4aa87ed356_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/controller-rhel9@sha256:cb6992dd9e3b8ff0cd5a96c7d72c2bd543a3ca388fbf87efec36aa4f1c170fe4_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/eda-controller-ui-rhel9@sha256:4589dd9e21834c2d4f61712256d3e69b473fbe01c118c46e7c796c39715d3060_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/lightspeed-rhel9@sha256:a9d59bb30f983980d8d59ef97f54dbf5427cfd1a24210aa5843be4ddf0f74143_amd64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
| Red Hat | registry.redhat.io/ansible-automation-platform-27/lightspeed-chatbot-rhel9@sha256:500c52d19ddfb4cd15e4ba0c94268250d5d83442c2c67381b3cb9bb7613c23d4_arm64 as a component of Red Hat Ansible Automation Platform 2.7 | * |
…and 42 more
Timeline
- Aug 4, 2026 CVE Published
- Aug 24, 2026 CVE Updated
- Aug 24, 2026 Distribution Patch
- Aug 24, 2026 Distribution Patch
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
- Aug 24, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:50340 advisory
- https://access.redhat.com/security/cve/CVE-2026-11332 advisory
- https://access.redhat.com/security/cve/CVE-2026-12383 advisory
- https://access.redhat.com/security/cve/CVE-2026-13149 advisory
- https://access.redhat.com/security/cve/CVE-2026-13676 advisory
- https://access.redhat.com/security/cve/CVE-2026-18141 advisory
- https://access.redhat.com/security/cve/CVE-2026-34993 advisory
- https://access.redhat.com/security/cve/CVE-2026-40898 advisory
- https://access.redhat.com/security/cve/CVE-2026-44545 advisory
- https://access.redhat.com/security/cve/CVE-2026-48526 advisory
- https://access.redhat.com/security/cve/CVE-2026-48990 advisory
- https://access.redhat.com/security/cve/CVE-2026-54058 advisory
- https://access.redhat.com/security/cve/CVE-2026-54060 advisory
- https://access.redhat.com/security/cve/CVE-2026-54283 advisory
- https://access.redhat.com/security/cve/CVE-2026-55379 advisory
- https://access.redhat.com/security/cve/CVE-2026-55380 advisory
- https://access.redhat.com/security/cve/CVE-2026-59197 advisory
- https://access.redhat.com/security/cve/CVE-2026-59886 advisory
- https://access.redhat.com/security/cve/CVE-2026-59939 advisory
- https://access.redhat.com/security/updates/classification/ advisory
…and 89 more