The vulnerability CVE-2026-11332 exists in ansible-core, specifically in the ansible-galaxy role install command which processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This injection can lead to arbitrary code execution on the system of any user who installs the malicious role via ansible-galaxy role install. The vulnerability is classified under CWE-88 (Improper Neutralization of Argument Delimiters in a Command). The affected product is Red Hat Ansible Automation Platform 2.5 for RHEL 8, specifically versions >=2.5.0 and <2.6.0. Red Hat has issued security advisories (RHSA-2026:42078 and RHSA-2026:42079) that include fixes for this vulnerability in version 2.6 and later. The CVSS v3.1 score is 7.8, indicating high severity, with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows a malicious role author to execute arbitrary code on the machine of a user who installs the crafted role. This can compromise the confidentiality, integrity, and availability of the affected system. The vulnerability requires local access and user interaction (installing the malicious role) but does not require privileges. The impact is rated high due to the potential for full system compromise.

Red Hat has released official patches for this vulnerability in Red Hat Ansible Automation Platform version 2.6 and later. Users running affected versions (>=2.5.0 <2.6.0) should upgrade to the fixed versions as documented in Red Hat advisories RHSA-2026:42078 and RHSA-2026:42079. Applying these updates will remediate the vulnerability. No additional mitigation steps are required beyond applying the official patches.