CVE-2026-11332highCWE-88

CVE-2026-11332: fallo de gravedad alta en Red Hat Migration Toolkit for Applications 8

Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Red Hat Enterprise Linux+ Monitorear Red Hat OpenShift Container Platform

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.8epss 0.2%
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
Red Hat · Migration Toolkit for Applications 8Red Hat · Migration Toolkit for VirtualizationRed Hat · OpenShift Service Mesh 3Red Hat · Red Hat Advanced Cluster Management for Kubernetes 2Red Hat · Red Hat Ansible Automation Platform 2Red Hat · Red Hat Ansible Automation Platform 2.5Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 8Red Hat · Red Hat Ansible Automation Platform 2.5 for RHEL 9Red Hat · Red Hat Ansible Automation Platform 2.6Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 10Red Hat · Red Hat Ansible Automation Platform 2.6 for RHEL 9Red Hat · Red Hat Ansible Automation Platform 2.7Red Hat · Red Hat Ansible Automation Platform 2.7 for RHEL 10Red Hat · Red Hat Ansible Automation Platform 2.7 for RHEL 9Red Hat · Red Hat Ansible Automation Platform Ansible Core 2Red Hat · Red Hat Discovery 2Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 10.0 Extended Update SupportRed Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9Red Hat · Red Hat Enterprise Linux 9.4 Update Services for SAP SolutionsRed Hat · Red Hat Enterprise Linux 9.6 Extended Update SupportRed Hat · Red Hat OpenShift Container Platform 4.19Red Hat · Red Hat OpenShift Container Platform 4.20Red Hat · Red Hat OpenShift Container Platform 4.21Red Hat · Red Hat OpenShift Container Platform 5Red Hat · Red Hat Satellite 6.17 for RHEL 9Red Hat · Red Hat Satellite 6.18 for RHEL 9Red Hat · Red Hat Satellite 6.19 for RHEL 9Red Hat · Self-service automation portal 2Red Hat · Service Telemetry Framework 1.5
CVEs relacionadas — Red Hat Migration Toolkit for Applications 8

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-11831MEDIUMNpm-serialize-javascript: cross-site scripting (xss) in serialize-javascriptEPSS 1.1%CVE-2025-8556LOWGithub.com/cloudflare/circl: circl-fourq: missing and wrong validation can lead to incorrect resultsEPSS 0.5%CVE-2026-89091HIGHAnsible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code executionEPSS 0.5%CVE-2026-92982HIGHAnsible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injectionEPSS 0.5%CVE-2025-11060MEDIUMSurrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptionsEPSS 0.3%CVE-2026-123037MEDIUMAnsible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902)EPSS 0.1%