python-galaxy-ng vulnerabilities

CVEs whose affected-version data names the python-galaxy-ng package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

2 CVEsRSS

CVE-2026-79717Medium· 6.4

2mo ago

Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction

A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, inc…

▾ SunlitRed Hat · ansible-automation-platform-24/hub-rhel8EPSS 0.37%via CVEORG

CVE-2026-12398High· 7.5

4mo ago

Galaxy_ng: shell injection in legacy role import via unsanitized git ref names

A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with …

▾ TwilightRed Hat · ansible-automation-platform-24/hub-rhel8EPSS 0.89%via CVEORG