This vulnerability in ansible-core affects the ansible-galaxy role install command, which processes dependencies from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, an attacker can inject arbitrary git configuration flags through the src field. This injection can lead to arbitrary code execution on the user's machine when the role is installed. The CVSS 3.1 score is 7.8 (high), reflecting local attack vector with low complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. Red Hat has published an advisory but has not yet provided an official fix or mitigation guidance.

Successful exploitation allows arbitrary code execution on the machine of a user who installs a malicious Ansible role via ansible-galaxy. This compromises confidentiality, integrity, and availability of the affected system. The attack requires the user to install a crafted role, implying user interaction is necessary. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-11332 for current remediation guidance. Until a fix is available, users should exercise caution when installing roles from untrusted sources via ansible-galaxy. Avoid installing roles from unknown or unverified authors to reduce risk.