galaxy_ng Legacy Role Import RCE via Command Injection (CVE-2026-12398)

Vulnerability Overview Vulnerability ID: Bug 2489180 (CVE-2026-12398) Vulnerability Type: Command Injection Description: A command injection vulnerability was discovered in the legacy role import functionality of . The function in constructs shell commands via f-string interpolation using unsanitized git reference names (branch/tag names from the parameter) and executes them using . An authenticated user who controls a git repository can create branches or tags with shell metacharacters (such as , , , ) in their names. When the legacy role import process handles these references, the shell metacharacters are interpreted by the shell, leading to Remote Code Execution (RCE). Scope of Impact Affected Product: Red Hat Bugzilla - Bug 2489180 Operating System: Linux Priority: Medium Severity: Medium Target Milestone: Unspecified Assigned To: Product Security QA Contact: Unspecified Doc Contact: Unspecified URL: Unspecified Whiteboard: Unspecified Dependencies: Unspecified Blocks: Unspecified TreeView: Depends on / Blocks Remediation Fixed Version: Unspecified Cloned From: Unspecified Environment: Unspecified Last Closed: Unspecified Freeze: Unspecified CC List: 11 Users (Details) Detailed Description Reported Time: 2026-06-16 13:32 UTC by OSIDB Bzimport Modified Time: 2026-06-16 14:50 UTC Keywords: Security Status: NEW Alias: CVE-2026-12398 Component: vulnerability Version: Unspecified Hardware: All OS: Linux Priority: Medium Severity: Medium Target Milestone: Unspecified Assigned To: Product Security QA Contact: Unspecified Doc Contact: Unspecified URL: Unspecified Whiteboard: Unspecified Dependencies: Unspecified Blocks: Unspecified TreeView: Depends on / Blocks Vulnerability Details Vulnerability Requirements: must be set to . This is not the default configuration in any released version of Red Hat Ansible Automation Platform (2.4 to 2.6). When this setting defaults to , the v1 API routes are not registered in Django URL routing, and the vulnerable endpoint returns a 404. However, any deployment that explicitly enables legacy role support (e.g., or custom configuration) is exposed to authenticated RCE. Secondary Vector: An parameter exists, which accepts arbitrary URLs without validation (enabling SSRF). However, the git clone operation on this path uses , preventing shell injection via this specific parameter. Code Snippet Comments Comments: You need to log in to leave a comment or make changes. Attachments Attachments: None Additional Information Reporter: OSIDB Bzimport Reported Time: 2026-06-16 13:32 UTC Modified Time: 2026-06-16 14:50 UTC CC List: 11 Users (Details) Summary This vulnerability involves a command injection issue in the legacy role import functionality of , potentially leading to Remote Code Execution. The remediation is not yet specified, but it is recommended to ensure is set to to mitigate potential risks.

Goal Reached Thanks to every supporter — we hit 100%!

galaxy_ng Legacy Role Import RCE via Command Injection (CVE-2026-12398)

More from this source