CVE-2026-12398 PUBLISHED

A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.

The following practices would help for avoiding exposure and mitigate this flaw:

1. Ensure that GALAXY_ENABLE_LEGACY_ROLES is set to False (the default) in your Galaxy/Hub configuration. This prevents the v1 API routes from being registered, making the vulnerable endpoint entirely unreachable.

2. If legacy role support must be enabled, restrict access to the Galaxy/Hub API to trusted users only. The vulnerability requires authentication, so limiting who can authenticate reduces exposure.

3. Monitor import activity for suspicious git references containing shell metacharacters in branch or tag names.

• This issue was discovered by Chris Meyers (Red Hat).

• https://access.redhat.com/security/cve/CVE-2026-12398
• RHBZ#2489180

• Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') CWE