CVE-2026-11332
2 advisories.
PyPI/ansible-core CVE-2026-11332: high 7.8, EPSS 0.22%
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution
Action: Upgrade ansible-core to 2.16.19rc1 or later.
pip install ansible-core==2.16.19rc1pip install ansible-core==2.18.18rc1pip install ansible-core==2.19.11rc1pip install ansible-core==2.20.7rc1pip install ansible-core==2.21.1rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.16.19rc1 | - |
| 2.17.0b1 | 2.18.18rc1 | - |
| 2.19.0b1 | 2.19.11rc1 | - |
| 2.20.0b1 | 2.20.7rc1 | - |
| 2.21.0b1 | 2.21.1rc1 | - |
Fixed versions
| 2.16.19rc1 | 2.18.18rc1 | 2.19.11rc1 | 2.20.7rc1 | 2.21.1rc1 |
Sources
- osv: GHSA-w8p5-mx5w-cpqj
- https://nvd.nist.gov/vuln/detail/CVE-2026-11332
- https://github.com/ansible/ansible/pull/87070
- https://github.com/ansible/ansible/commit/edee59aa15abcc74d920bb3e9c3835ab8db05a2f
- https://access.redhat.com/security/cve/CVE-2026-11332
- https://bugzilla.redhat.com/show_bug.cgi?id=2485379
- https://github.com/ansible/ansible
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json
CVE-2026-11332 · published · modified · JSON
PyPI/ansible-core CVE-2026-11332: high 7.8, EPSS 0.22%
ansible-core: Argument injection in ansible-galaxy role install leads to arbitrary code execution
Action: Upgrade ansible-core to 2.16.19rc1 or later.
pip install ansible-core==2.16.19rc1pip install ansible-core==2.18.18rc1pip install ansible-core==2.19.11rc1pip install ansible-core==2.20.7rc1pip install ansible-core==2.21.1rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.16.19rc1 | - |
| 2.17.0b1 | 2.18.18rc1 | - |
| 2.19.0b1 | 2.19.11rc1 | - |
| 2.20.0b1 | 2.20.7rc1 | - |
| 2.21.0b1 | 2.21.1rc1 | - |
Fixed versions
| 2.16.19rc1 | 2.18.18rc1 | 2.19.11rc1 | 2.20.7rc1 | 2.21.1rc1 |
Sources
- osv: PYSEC-2026-3458
- https://nvd.nist.gov/vuln/detail/CVE-2026-11332
- https://github.com/ansible/ansible/pull/87070
- https://github.com/ansible/ansible/commit/edee59aa15abcc74d920bb3e9c3835ab8db05a2f
- https://access.redhat.com/security/cve/CVE-2026-11332
- https://bugzilla.redhat.com/show_bug.cgi?id=2485379
- https://github.com/ansible/ansible
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-11332.json
- https://pypi.org/project/ansible-core
- https://github.com/advisories/GHSA-w8p5-mx5w-cpqj
CVE-2026-11332 · published · modified · JSON