EUVD-2026-37124
GHSA-6hw7-j4jw-wpff
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable API (AV:N) but requires non-default GALAXY_ENABLE_LEGACY_ROLES and attacker-controlled git ref (AC:H); needs an authenticated account (PR:L); RCE on pulp worker yields full C/I/A impact.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
Lifecycle Timeline
1DescriptionCVE.org
A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.
AnalysisAI
Remote code execution in galaxy_ng's legacy role import API (v1) allows an authenticated user controlling a git repository to execute arbitrary commands on the pulp worker by crafting a branch or tag name containing shell metacharacters. The flaw stems from unsanitized git ref interpolation into a subprocess.run() call with shell=True inside do_git_checkout(), and only affects deployments where GALAXY_ENABLE_LEGACY_ROLES is explicitly enabled (non-default). No public exploit identified at time of analysis.
Technical ContextAI
galaxy_ng is the Red Hat Ansible Galaxy content service that ships as part of Red Hat Ansible Automation Platform 2 (per the provided CPEs). The vulnerable code path lives in the legacy v1 role import API, which clones user-supplied git repositories on a pulp worker to import Ansible roles. The do_git_checkout() helper builds a shell command string that concatenates a git ref (branch or tag name) supplied by the remote repository and then runs it through Python's subprocess.run(..., shell=True), so the shell - not git - parses the ref. This is a textbook CWE-78 (OS Command Injection): metacharacters such as ;, &&, $(...) or backticks embedded in the ref are interpreted by /bin/sh and executed in the worker context.
RemediationAI
Patch availability is not stated explicitly in the supplied data, so treat this as 'Patch available per vendor advisory' and consult https://access.redhat.com/security/cve/CVE-2026-12398 and https://bugzilla.redhat.com/show_bug.cgi?id=2489180 for the exact fixed galaxy_ng / Ansible Automation Platform 2 builds. The simplest compensating control is to set GALAXY_ENABLE_LEGACY_ROLES=False (the default), which removes the vulnerable v1 role import endpoint entirely; the trade-off is that users can no longer import legacy Galaxy v1 roles and must migrate to collections. If legacy roles must remain enabled, restrict who can authenticate to the Galaxy API and who can submit role imports (limit to trusted internal users), and front the API with a reverse proxy that blocks POSTs to the v1 role import endpoint from untrusted networks. As a deeper hardening measure, run the pulp worker under a dedicated low-privilege account in a sandbox (container with no outbound network, read-only FS) so that command execution via a malicious git ref cannot pivot to secrets or signing keys.
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated r
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary she
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2:
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user,
Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding
Container privilege escalation in Red Hat Ansible Automation Platform 2 allows non-root users within affected container
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today