CVE-2026-12398: Command Injection in galaxy_ng Legacy Role Import API

Technical summary

CVE-2026-12398 is a command injection vulnerability in the do_git_checkout() function within galaxy_ng's legacy role import API (v1). The function fails to sanitize git ref names (branches and tags) before interpolating them into shell commands executed via subprocess.run() with shell=True. This allows an authenticated attacker controlling a git repository to inject arbitrary shell commands by creating branches or tags with metacharacter payloads. The vulnerability is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration. The attack surface is restricted to authenticated users, but the impact is severe—remote code execution on pulp worker processes.

Business impact

Successful exploitation enables an authenticated attacker to execute arbitrary code with the privileges of the pulp worker process. In production environments, this could lead to data exfiltration, lateral movement, compromise of artifact repositories, or disruption of CI/CD pipelines that depend on galaxy_ng for role distribution. Organizations using galaxy_ng as a central artifact repository face heightened risk if legacy role imports are enabled. The authentication requirement provides some protection, but compromised or malicious insider accounts can weaponize this flaw. The impact severity (HIGH) reflects the combination of remote code execution capability and potential access to sensitive build and deployment workflows.

Affected systems

galaxy_ng installations with GALAXY_ENABLE_LEGACY_ROLES explicitly set to True are vulnerable. The default configuration does not enable legacy roles, so many deployments may be unaffected. However, organizations maintaining backwards compatibility with older role import workflows or those migrating from legacy systems are at risk. The vulnerability targets the pulp worker process, so any system running galaxy_ng with legacy role import enabled and accepting connections from untrusted git repositories should be considered affected. Verify your galaxy_ng configuration to determine if legacy roles are enabled.

Exploitability

Exploitation requires authentication and control over a git repository whose roles are imported via the legacy API. The attacker must create a crafted branch or tag name containing shell metacharacters (e.g., backticks, semicolons, pipes) that will be injected into the git checkout command. Once a user or automated process imports a role from this repository, the malicious payload executes on the pulp worker. The attack complexity is moderate—the attacker must understand the injection point and craft a valid payload, but no user interaction or special network conditions are required beyond authentication. The barrier to entry is relatively low for an insider or a user with repository control.

Remediation

Immediately audit your galaxy_ng configuration to determine whether GALAXY_ENABLE_LEGACY_ROLES is set to True. If legacy role imports are not required, disable this feature. If legacy support must be maintained, apply the security patch released for this vulnerability as soon as testing permits. The fix should sanitize git ref names before shell interpolation, likely by using parameterized subprocess calls or shell escaping. Review git import sources and restrict role imports to trusted, internally-managed repositories. Consider implementing network segmentation to limit pulp worker exposure and monitor worker processes for unexpected command execution.

Patch guidance

Consult the galaxy_ng project advisory and security releases for patched versions addressing CVE-2026-12398. Apply patches to all galaxy_ng instances, prioritizing those with GALAXY_ENABLE_LEGACY_ROLES enabled. Test patches in a staging environment to ensure no regression in legacy role import functionality before production deployment. If patching is delayed, disable legacy role support as an interim control. Verify the patch by confirming that git ref names containing metacharacters no longer result in command injection.

Detection guidance

Monitor pulp worker logs for subprocess execution of unexpected commands or error messages related to malformed git ref names. Look for audit logs indicating role import attempts from repositories with suspicious branch or tag names containing special characters. Network monitoring can flag unusual outbound connections from pulp worker processes that may indicate post-exploitation activity. Endpoint detection and response (EDR) tools should alert on any subprocess spawning from the galaxy_ng or pulp worker process with shell metacharacters in the command line. Review git repository branches and tags for anomalous names created by users without legitimate development roles.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.5), the remote code execution impact, and its relevance to artifact supply chain security. Although the default configuration does not enable legacy roles, any deployment with legacy role support active faces a direct code execution risk. The authentication requirement is a mitigating factor, but the low complexity of exploitation and the criticality of pulp worker integrity justify rapid patching and configuration review. Organizations should treat this as a priority based on their actual enablement of legacy roles and the sensitivity of their artifact repositories.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects: Attack Vector Network (code execution across the network via git imports), Access Complexity High (attacker must craft a specific payload and control a repository), Privilege Level Local (authentication required), User Interaction None (no user action needed once authenticated), Scope Unchanged (impact is limited to the pulp worker), and Confidentiality/Integrity/Availability all High (arbitrary code execution grants all three impacts). The score appropriately captures a severe remote code execution risk moderated by the authentication requirement and non-default configuration. Organizations with legacy roles enabled should treat this as effectively CRITICAL in their risk context.

Frequently asked questions