RHSA-2026:87124 | Vulnetix

RHSA-2026:87124 PUBLISHED CVSS 7 HIGH

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

Risk Scores

CVSS 3.1

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
Red Hat	registry.redhat.io/ansible-automation-platform-27/receptor-rhel9@sha256:a5ea5161ab3c5d275485f2a8ff31c8aeaac3c740dc12a36e1f8b929f46900787_arm64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/eda-controller-ui-rhel9@sha256:873f095b34c5b98fc8d1de3acc658cc409b5a9df1adea258e6523f12b20f447a_arm64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/lightspeed-rhel9-operator@sha256:8cca3f06ea3f9d0e25048e196d6627d2688613955be4dd2c313b3acda4713505_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/lightspeed-rhel9-operator@sha256:feb96aca3c9291cc4e8e3715cb20334283924e978de3772547ff04fe5bbfd72f_arm64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/controller-rhel9@sha256:5c6a59a98ce88b77fe54f0a2b3ac4b8ee8642fe8246c4d134f50a32dcf09516a_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/metrics-service-rhel9-operator@sha256:00baa4db164f8ff1fbcf3b3b39cd285d7527ec86055ffbdc377194a6365bea0e_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/eda-controller-rhel9@sha256:e40310bfa9bb7d1e597bafd12133b77efc24f14e68f93dfcf3baaa69f60edcbb_arm64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/ee-minimal-rhel9@sha256:6233050175e614e28a197a28bbecd2f8de21e606cc9ff18090489a03bec16bd7_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/gateway-rhel9-operator@sha256:018321c28711b144356ced62c0187af53d0afd637778eb81f7a34bdc2a0076cb_arm64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9@sha256:c808eb39ea3fc92c3e1524e2345378ca4e5cf26044e8f6ba21f059315fbe4a83_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/metrics-service-rhel9@sha256:c711fc1f199391f31d8d0df124b3d9fb6e8d6afd35d87cd4b9bef22e6ad12483_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/lightspeed-rhel9@sha256:b29ae66ada50d2421ec4f0073ad62d1b9572a10e15f776234a2b3aa55c60ce95_arm64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/platform-resource-rhel9-operator@sha256:ce5fd33ad9b3fdbaa46267b0ef98b390ec01d0c9aa61b53475585ba8f5fbb8a5_arm64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/mcp-server-rhel9@sha256:83dcac9bde0389feb03cedd5e344ce6a89c7973128781e41ad7e6ded12780529_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9@sha256:3fc08cac1d10813f10a1a5e9b27012c63b5e447ef9863fb4b2680c863154c835_arm64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/receptor-rhel9@sha256:f269f3a8788fe6a6147125633d7beae1ae61d4e563cf9b9400fe1aeee10bdd1f_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/ansible-devspaces-rhel9@sha256:affa5f76c69a86bcd13ba936069b520003c89b10a0fc91680f21f474db843a77_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/ee-supported-rhel9@sha256:f53052abfb32b79c66cc07f9d05a5dcba1443d2381fc6e27d13d5e87edb21e7c_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/metrics-service-rhel9@sha256:cf902d1533bd36ec8177427b538045301bda2c2a865ffaf282b0c45cf9416a1d_arm64 as a component of Red Hat Ansible Automation Platform 2.7	*
Red Hat	registry.redhat.io/ansible-automation-platform-27/mcp-tools-rhel9@sha256:7a25e4a3a4c7742b5220616cf0c4e2910e7fdf88dcbf0e873e7c7248f3a1b9c4_amd64 as a component of Red Hat Ansible Automation Platform 2.7	*

…and 44 more

Timeline

Oct 21, 2026 CVE Published
Oct 27, 2026 CVE Updated
Oct 27, 2026 Distribution Patch
Oct 27, 2026 Distribution Patch
Oct 27, 2026 Security Advisory
Oct 27, 2026 Security Advisory
Oct 27, 2026 Security Advisory
Oct 27, 2026 Security Advisory
Oct 27, 2026 Security Advisory
Oct 27, 2026 Security Advisory
Oct 27, 2026 Security Advisory
Oct 27, 2026 Security Advisory

References

https://access.redhat.com/errata/RHSA-2026:87124 advisory
https://access.redhat.com/security/cve/CVE-2026-102266 advisory
https://access.redhat.com/security/cve/CVE-2026-102267 advisory
https://access.redhat.com/security/cve/CVE-2026-102268 advisory
https://access.redhat.com/security/cve/CVE-2026-102271 advisory
https://access.redhat.com/security/cve/CVE-2026-102272 advisory
https://access.redhat.com/security/cve/CVE-2026-102273 advisory
https://access.redhat.com/security/cve/CVE-2026-102925 advisory
https://access.redhat.com/security/cve/CVE-2026-102930 advisory
https://access.redhat.com/security/cve/CVE-2026-102937 advisory
https://access.redhat.com/security/cve/CVE-2026-102938 advisory
https://access.redhat.com/security/cve/CVE-2026-103262 advisory
https://access.redhat.com/security/cve/CVE-2026-104851 advisory
https://access.redhat.com/security/cve/CVE-2026-11332 advisory
https://access.redhat.com/security/cve/CVE-2026-27459 advisory
https://access.redhat.com/security/cve/CVE-2026-63374 advisory
https://access.redhat.com/security/cve/CVE-2026-87817 advisory
https://access.redhat.com/security/cve/CVE-2026-90959 advisory
https://access.redhat.com/security/cve/CVE-2026-92982 advisory
https://access.redhat.com/security/cve/CVE-2026-94416 advisory

…and 124 more

Open in Interactive Console →