CVE-2026-79717— Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction
Quick assessment
Affected
Red Hat Red Hat Ansible Automation Platform 2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 galaxy_ng（Pulp 的 Ansible Galaxy 服务器插件）中发现了一个服务端请求伪造（SSRF）漏洞。拥有命名空间管理权限的经过身份验证的用户，可以将命名空间头像 URL 设置为任意地址，包括内部网络、回环地址或云实例元数据端点。后台工作进程在获取该 URL 时不会检查目标地址，从而使攻击者能够探测内部服务并枚举可达的 IP 地址。此外，HTTP 客户端未配置总体超时时间，因此缓慢响应或无响应的目标可能导致工作进程被占用，从而引发拒绝服务（DoS）。
Affected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | any |
affected |
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected | ||
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79717
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction
Source: CVE Program / CVE List V5
Vulnerability Description
A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata endpoints. A background worker fetches that URL without checking the destination, which lets the attacker probe internal services and enumerate reachable IP addresses. The HTTP client is also configured without an overall timeout, so a slow or non-responsive target can pin workers and cause a denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
| Red Hat | Red Hat Ansible Automation Platform 2 | - |
cpe:/a:redhat:ansible_automation_platform:2
|
|
II. Public POCs for CVE-2026-79717
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79717
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-79717 (2)
Other References for CVE-2026-79717 (1)
Same Patch Batch · Red Hat · 2026-08-25 · 10 CVEs total
| CVE-2026-79992 | 7.8 HIGH | Emacs: local shell command injection through the user field in emacs tramp |
| CVE-2026-79655 | 7.8 HIGH | Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targ |
| CVE-2026-80186 | 7.6 HIGH | Bluez: stack overflow in name2utf8 causes dos and potential code execution |
| CVE-2026-78701 | 6.5 MEDIUM | 389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall d |
| CVE-2026-78322 | 6.5 MEDIUM | File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar hand |
| CVE-2026-79652 | 5.9 MEDIUM | Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce cons |
| CVE-2026-80185 | 5.7 MEDIUM | Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary cod |
| CVE-2026-77680 | 5.3 MEDIUM | Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025 |
| CVE-2026-80101 | 4.4 MEDIUM | Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-l |
IV. Related Vulnerabilities
Same product: Red Hat Ansible Automation Platform 2
-
CVE-2026-12564
Automation-controller: automation-controller: kubernetes ser -
CVE-2026-19730
Podman: podman: quadlet install --replace non-truncating wri -
CVE-2026-44191
Ansible-lightspeed: visual studio code ansible lightspeed ex -
CVE-2026-44187
Ansible-lightspeed: ansible lightspeed extension for visual -
CVE-2026-44192
Ansible-lightspeed: ansible lightspeed mcp server: remote co
Same vendor: Red Hat
-
CVE-2026-79654
Ketello: katello content view history api cross-organization -
CVE-2026-80185
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent- -
CVE-2026-80186
Bluez: stack overflow in name2utf8 causes dos and potential -
CVE-2026-80101
Gimp: multiple heap out-of-bounds reads in xwd loader from u -
CVE-2026-77680
Libsoup3: libsoup: quadratic cpu denial of service in http r
Same weakness: CWE-918
-
CVE-2026-80350
OneUptime before 12.0.7 Server-Side Request Forgery via IPv4 -
CVE-2026-80347
mcp-fetch through 1.6.3 Server-Side Request Forgery via Unst -
CVE-2026-45019
Chainlit: SSRF via MCP SSE and streamable-http transports al -
CVE-2026-79788
Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Req -
CVE-2026-76193
Adobe Campaign Classic (ACC) | Server-Side Request Forgery (
V. Comments for CVE-2026-79717
No comments yet