PT-2026-49716 · Galaxy Ng · Galaxy-Ng

Chris Meyers · CVE-2026-12398 · Published 2026-06-16 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions galaxy ng (affected versions not specified)

Description A command injection issue exists in the legacy role import API (v1) where the do git checkout() function interpolates unsanitized git ref names, such as branch or tag names, into shell commands executed via subprocess.run() with shell=True. An authenticated user with control over a git repository can use shell metacharacters in a branch or tag name to achieve remote code execution on the pulp worker. This endpoint is only accessible when the GALAXY ENABLE LEGACY ROLES variable is set to True.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Set GALAXY ENABLE LEGACY ROLES to False to disable the vulnerable legacy role import API.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-12398

GHSA-6HW7-J4JW-WPFF

PYSEC-2026-2486

Affected Products

Galaxy-Ng

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2026-12398 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2486 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6hw7-j4jw-wpff · Vendor Advisory
• https://github.com/ansible/galaxy_ng · Note
• https://github.com/advisories/GHSA-6hw7-j4jw-wpff · Note
• https://t.me/cveNotify/176431 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2489180 · Note
• https://t.me/CVEtracker/57004 · Telegram Post
• https://twitter.com/ptdbugs/status/2067629310077235322 · Twitter Post
• https://twitter.com/CVEnew/status/2066980901280776416 · Twitter Post
• https://t.me/cveNotify/178820 · Telegram Post
• https://pypi.org/project/galaxy-ng · Note
• https://access.redhat.com/security/cve/CVE-2026-12398 · Note