python3x-galaxy-ng vulnerabilities
CVEs whose affected-version data names the python3x-galaxy-ng package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-79717Medium· 6.4Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restriction
A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, inc…
▾ SunlitRed Hat · ansible-automation-platform-24/hub-rhel8EPSS 0.37%via CVEORG
CVE-2026-12398High· 7.5Galaxy_ng: shell injection in legacy role import via unsanitized git ref names
A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with …
▾ TwilightRed Hat · ansible-automation-platform-24/hub-rhel8EPSS 0.89%via CVEORG