CVE-2026-11332: Red Hat Migration Toolkit For Applications 8

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

Affected products

Red Hat Migration Toolkit For Applications 8
Red Hat Migration Toolkit For Virtualization
Red Hat Openshift Service Mesh 3
Red Hat Red Hat Advanced Cluster Management For Kubernetes 2
Red Hat Red Hat Ansible Automation Platform 2
Red Hat Red Hat Ansible Automation Platform 2.5: before 1785381341 (fixed in 1785381341); before 1785429657 (fixed in 1785429657); before 1785430174 (fixed in 1785430174); before 1785425335 (fixed in 1785425335); before 1785449441 (fixed in 1785449441)
Red Hat Red Hat Ansible Automation Platform 2.5 For Rhel 8: before 1:2.16.19-1.el8ap (fixed in 1:2.16.19-1.el8ap)
Red Hat Red Hat Ansible Automation Platform 2.5 For Rhel 9: before 1:2.16.19-1.el9ap (fixed in 1:2.16.19-1.el9ap)
Red Hat Red Hat Ansible Automation Platform 2.6: before 1785647559 (fixed in 1785647559); before 1785649812 (fixed in 1785649812); before 1785633038 (fixed in 1785633038); before 1785775360 (fixed in 1785775360)
Red Hat Red Hat Ansible Automation Platform 2.6 For Rhel 10: before 2:2.16.19-1.el10ap (fixed in 2:2.16.19-1.el10ap)
Red Hat Red Hat Ansible Automation Platform 2.6 For Rhel 9: before 1:2.16.19-1.el9ap (fixed in 1:2.16.19-1.el9ap)
Red Hat Red Hat Ansible Automation Platform 2.7: before 1785446384 (fixed in 1785446384); before 1785448519 (fixed in 1785448519); before 1785374869 (fixed in 1785374869); before 1785375273 (fixed in 1785375273)
Red Hat Red Hat Ansible Automation Platform 2.7 For Rhel 10: before 2:2.16.19-1.el10ap (fixed in 2:2.16.19-1.el10ap)
Red Hat Red Hat Ansible Automation Platform 2.7 For Rhel 9: before 1:2.16.19-1.el9ap (fixed in 1:2.16.19-1.el9ap)
Red Hat Red Hat Ansible Automation Platform Ansible Core 2
Red Hat Red Hat Discovery 2: before 1784821670 (fixed in 1784821670)
Red Hat Red Hat Enterprise Linux 10: before 1:2.16.16-2.el10_2.1 (fixed in 1:2.16.16-2.el10_2.1)
Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support: before 1:2.16.14-1.el10_0.1 (fixed in 1:2.16.14-1.el10_0.1)
Red Hat Red Hat Enterprise Linux 8: before 0:2.16.3-4.el8_10 (fixed in 0:2.16.3-4.el8_10)
Red Hat Red Hat Enterprise Linux 9: before 1:2.14.18-3.el9_8.1 (fixed in 1:2.14.18-3.el9_8.1)
Red Hat Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions: before 1:2.14.14-1.el9_4.1 (fixed in 1:2.14.14-1.el9_4.1)
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support: before 1:2.14.18-1.el9_6.1 (fixed in 1:2.14.18-1.el9_6.1)
Red Hat Red Hat Openshift Container Platform 4
Red Hat Red Hat Satellite 6.17 For Rhel 9: before 1:2.16.19-1.el9sat (fixed in 1:2.16.19-1.el9sat)
Red Hat Red Hat Satellite 6.18 For Rhel 9: before 1:2.16.19-1.el9sat (fixed in 1:2.16.19-1.el9sat); before 0:1.3.1-5.el9pc (fixed in 0:1.3.1-5.el9pc); before 0:3.73.30-3.el9pc (fixed in 0:3.73.30-3.el9pc)
and 3 more

Published 2026-06-05. Last modified 2026-10-08.