CVE-2026-12398Galaxy_ng: shell injection in legacy role import via unsanitized git ref names
- 7.5HighCVSS base score
- 0.89%Exploitation in 30 daysEPSS · top 40% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.
Timeline
ID reserved
By redhat
Published
- 5 months later
· 5 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| redhatCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.89% · top 40% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
Red Hat · Red Hat Ansible Automation Platform 2
All versions: unaffected
Red Hat · Red Hat Ansible Automation Platform 2
All versions: affected
Red Hat · Red Hat Ansible Automation Platform 2
All versions: affected
Red Hat · Red Hat Ansible Automation Platform 2
All versions: affected
Red Hat · Red Hat Ansible Automation Platform 2
All versions: affected
Red Hat · Red Hat Ansible Automation Platform 2
All versions: unknown
Red Hat · Red Hat Ansible Automation Platform 2
All versions: unknown
Red Hat · Red Hat Ansible Automation Platform 2
All versions: unknown
Red Hat · Red Hat Ansible Automation Platform 2
All versions: unknown
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPIgalaxy-ngGHSA-6hw7-j4jw-wpff (opens in a new tab)
What to do
Workaround: The following practices would help for avoiding exposure and mitigate this flaw: 1. Ensure that GALAXY_ENABLE_LEGACY_ROLES is set to False (the default) in your Galaxy/Hub configuration. This prevents the v1 API routes from being registered, making the vulnerable endpoint entirely unreachable. 2. If legacy role support must be enabled, restrict access to the Galaxy/Hub API to trusted users only. The vulnerability requires authentication, so limiting who can authenticate reduces exposure. 3. Monitor import activity for suspicious git references containing shell metacharacters in branch or tag names.
References
References2
- https://access.redhat.com/security/cve/CVE-2026-12398 (opens in a new tab)vdb-entryx_refsource_REDHAT
- RHBZ#2489180 (opens in a new tab)issue-trackingx_refsource_REDHAT
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-37124 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-6hw7-j4jw-wpff (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-12398)Record last updated .