Logo
Retour à la veille

CVE-2026-11332

Publié : 5 juin 2026
Modifié : 5 juin 2026
Lien officiel NVD
Score CVSS
7.8
HIGH

Description détaillée

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Références et Patchs

https://access.redhat.com/security/cve/CVE-2026-11332https://bugzilla.redhat.com/show_bug.cgi?id=2485379https://github.com/ansible/ansible

Dernières Vulnérabilités

CVE-2026-6209

Improper Access Control, Missing Authorization vulnerability in HAVELSAN Inc. Geographic Tracking System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Geographic Tracking System: before v0.0.2.

VOIR DÉTAILS

CVE-2026-6208

Authorization bypass through User-Controlled key vulnerability in HAVELSAN Inc. Geographic Tracking System allows Exploitation of Trusted Identifiers. This issue affects Geographic Tracking System: before v0.0.2.

VOIR DÉTAILS

CVE-2026-6207

Observable response discrepancy vulnerability in HAVELSAN Inc. Geographic Tracking System allows System Footprinting. This issue affects Geographic Tracking System: before v0.0.2.

VOIR DÉTAILS