CVE-2026-11332: Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

Synopsis

Argument injection in ansible-core's ansible-galaxy role install command allows a malicious role author to embed crafted git configuration flags inside a role's meta/requirements.yml file. The vulnerability is reached locally when a user runs ansible-galaxy role install, and requires the user to interact with a malicious role (for example, by installing it from a public or compromised source). Successful exploitation gives the attacker full code execution on the machine running the install command. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker does not need network access to the victim machine; they need an existing shell or process on the host, or the victim must pull and install a role the attacker controls.

• AuthenticationNot required

  No account or credentials on the target machine are required; any user capable of running ansible-galaxy is sufficient.

• Victim interactionRequired

  The victim must actively run ansible-galaxy role install against a role that contains the malicious meta/requirements.yml, making this a social-engineering or supply-chain vector.

• Attack complexityDetail

  Attack complexity is low: the injected arguments are processed deterministically with no race conditions or special memory-layout requirements needed.

Blast Radius

• Reads files and secrets accessible to the user running ansible-galaxy, including SSH keys, vault passwords, and environment variables.
• Writes or modifies files on the local filesystem under the permissions of the installing user.
• Executes arbitrary commands on the developer or CI machine performing the role install, enabling full host compromise at the privilege level of that user.
• Compromises CI/CD pipeline runners that automate role installation, potentially propagating malicious changes into production infrastructure.