CVE-2026-11332

Think of Ansible roles as “packages” of automation scripts. This issue is about what happens when you install a role: a malicious role can hide a trick inside its dependency instructions so that, when you run the install command, code runs on your computer instead of only setting up the role.

This matters if you use Red Hat Ansible Automation Platform 2 and run ansible-galaxy role install to install roles that aren’t fully trusted. It’s not something that silently affects you just by having Ansible installed; the risk is tied to installing a specially crafted malicious role. The reachability gate here is practical: it’s a risk only when an attacker’s role can get installed via ansible-galaxy role install (no known public exploitation details, and whether your default setup is reachable by default is not known).

This is an AMBER issue because it can lead to arbitrary code execution, but it requires you to install a malicious role through the role installation process. There is currently no confirmed fix/patch information available, so your immediate priority is preventing installation of untrusted roles and asking Red Hat for remediation guidance for CVE-2026-11332.