CVE-2026-12398

Name of the Vulnerable Software and Affected Versions galaxy ng (affected versions not specified)

Description A command injection issue exists in the legacy role import API (v1) where the do git checkout() function interpolates unsanitized git ref names, such as branch or tag names, into shell commands executed via subprocess.run() with shell=True. An authenticated user with control over a git repository can use shell metacharacters in a branch or tag name to achieve remote code execution on the pulp worker. This endpoint is only accessible when the GALAXY ENABLE LEGACY ROLES variable is set to True.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Set GALAXY ENABLE LEGACY ROLES to False to disable the vulnerable legacy role import API.