Server-Side Request Forgery Vulnerability in Ansible Galaxy Plugin by Red Hat
CVE-2026-79717

6.4MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Ansible Automation Platform 2
Vendor
CVE Published:
25 August 2026

What is CVE-2026-79717?

The Ansible Galaxy server plugin, galaxy_ng, has a server-side request forgery vulnerability that allows an authenticated user with namespace management permissions to manipulate a namespace avatar URL, directing it to arbitrary addresses. This includes private internal networks and cloud instance metadata endpoints. The plugin's background worker fetches the specified URL without proper validation of the destination, leading to potential probing of internal services and enumeration of reachable IP addresses. Additionally, the HTTP client lacks a definitive timeout configuration, which can result in a denial of service by tying up resources when communicating with slow or unresponsive targets.

References

https://access.redhat.com/security/cve/CVE-2026-79717
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2523431
issue-trackingx_refsource_REDHAT
https://github.com/ansible/galaxy_ng

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Arpit Jain (independent security researcher) for reporting this issue.
.