CVE-2026-11332 and is rated High severity with a CVSS score of 7.8. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.
What to do next
Remediation and response
Microsoft Security Response Center guidance
Vendor revision: Sep 27, 2026
Release Notes
Microsoft Security Response Center guidance
Vendor revision: Jun 11, 2026
CBL-Mariner Releases
Vendor-listed releases
2.17.11-2
CISA KEVNot listedBased on the latest collected catalog
EPSS0.2%Estimated 30-day exploitation probability
Ransomware useNot markedCISA KEV ransomware field
Threat actors0Source-linked actor relationships
Overview
What is CVE-2026-11332?
A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file.
Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.