The vulnerability CVE-2026-11332 affects the ansible-core component of Red Hat Ansible Automation Platform 2.5 for RHEL 8. The ansible-galaxy role install command improperly neutralizes argument delimiters when processing dependency specifications from a role's meta/requirements.yml file. This allows a malicious role author to inject arbitrary git configuration flags through the src field, resulting in arbitrary code execution on the system of any user who installs the malicious role. Red Hat has released security advisories (RHSA-2026:42078 and RHSA-2026:42079) that include patches fixing this issue. The vulnerability is rated as Important by Red Hat and has a CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Successful exploitation of this vulnerability allows an attacker who can supply a malicious Ansible role to execute arbitrary code on the target system during role installation. This compromises confidentiality, integrity, and availability of the affected system. The vulnerability requires local access with user interaction (user must run ansible-galaxy role install), but no privileges are required to trigger the flaw. There are no known exploits in the wild at the time of the advisory.

Red Hat has provided official security updates that fix this vulnerability in ansible-core. Users of Red Hat Ansible Automation Platform 2.5 for RHEL 8 should apply the patches as detailed in Red Hat Security Advisories RHSA-2026:42078 and RHSA-2026:42079. Applying these updates fully mitigates the vulnerability. No additional mitigation steps are required beyond applying the official fixes.