CVE-2026-12398
HIGH EPSS 54.8%
Published Jun 16, 20261w ago · Modified Jun 17, 20261w ago
7.5 CVSS 3.1
Published Jun 16, 2026 1w ago
Last Modified Jun 17, 2026 1w ago
Description
A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
EPSS Exploit Probability
54.8% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-78 OS Command Injection Injection
References 2
- access.redhat.com https://access.redhat.com/security/cve/CVE-2026-12398
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2489180
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.