EUVD-2026-65511
GHSA-86r5-w5c4-h244
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Network-reachable via authenticated namespace manager (PR:L); scope changes as worker fetches cross trust boundary; no integrity impact; partial availability impact from worker starvation.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Lifecycle Timeline
1DescriptionCVE.org
A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata endpoints. A background worker fetches that URL without checking the destination, which lets the attacker probe internal services and enumerate reachable IP addresses. The HTTP client is also configured without an overall timeout, so a slow or non-responsive target can pin workers and cause a denial of service.
AnalysisAI
Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding namespace management permissions to redirect a background worker process into probing arbitrary internal network addresses, including loopback interfaces and cloud instance metadata endpoints (e.g., 169.254.169.254). The dual-impact vulnerability enables both internal network reconnaissance (enumerating reachable IPs and reading service responses) and a denial-of-service condition against background workers due to the absence of an HTTP client timeout. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated AAP user account with namespace management permissions - this is not a default role granted to all users, but is a functional role in organizations that delegate Galaxy content curation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L accurately reflects the constrained but real risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a legitimate AAP account and namespace management permissions navigates to the namespace settings page and sets the avatar URL to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (or a similar cloud metadata path). The background worker fetches the URL from the server's network context, returning IAM credential material or internal service banners in a response the attacker can observe. … |
| Remediation | The primary remediation is to apply the vendor-released patch once Red Hat issues an updated galaxy_ng package via the AAP 2 errata channel at https://access.redhat.com/security/cve/CVE-2026-79717; no specific fixed version number is confirmed in available intelligence, so monitor that advisory for the patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Credential disclosure in Red Hat Ansible Automation Platform 2.5 and 2.6 allows any authenticated user to retrieve plain
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin
Arbitrary file write in pulpcore's FilesystemExport feature allows an authenticated administrator to escape the intended
mTLS authentication bypass in the Red Hat Ansible Automation Platform (AAP) Gateway Envoy proxy allows unauthenticated r
Arbitrary command execution in ansible-core allows an attacker who controls a collection source URI to run commands on a
Local code execution in the Visual Studio Code Ansible (Lightspeed) extension lets a malicious project run arbitrary she
Credential exfiltration via SSRF in AWX's GitHub webhook status callback affects Red Hat Ansible Automation Platform 2:
SSRF vulnerabilities in AWX notification backends (webhook, Mattermost, Rocket.Chat, and Grafana) allow an authenticated
Remote code execution in galaxy_ng's legacy role import API (v1) allows an authenticated user controlling a git reposito
Path traversal in AWX's project_archive action plugin allows arbitrary file writes to execution node filesystems outside
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user,
Container privilege escalation in Red Hat Ansible Automation Platform 2 allows non-root users within affected container
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today