CVE-2026-79717
Received Received - Intake

SSRF in Galaxy NG Ansible Galaxy Server Plugin

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: redhat-SADP

Description
A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata endpoints. A background worker fetches that URL without checking the destination, which lets the attacker probe internal services and enumerate reachable IP addresses. The HTTP client is also configured without an overall timeout, so a slow or non-responsive target can pin workers and cause a denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-79717
EUVD
EUVD-2026-65511

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
redhat galaxy_ng *
red_hat galaxy_ng From 2.4 (inc) to 2.7 (inc)
ansible galaxy_ng *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a server-side request forgery (SSRF) vulnerability in galaxy_ng, an Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an internal address, loopback, or cloud metadata endpoint. A background worker fetches this URL without validation, allowing the attacker to probe internal services and enumerate reachable IP addresses. The lack of an HTTP timeout can also cause denial of service by pinning workers.

Detection Guidance

To detect this SSRF vulnerability, monitor network traffic from Pulp worker nodes for outbound requests to internal RFC1918, loopback, link-local, or cloud metadata addresses. Check logs for namespace avatar downloads from unexpected URLs. Use tools like tcpdump or Wireshark to capture egress traffic from worker nodes.

Impact Analysis

An attacker could identify internal IP addresses and open ports on your network, potentially leading to further attacks. They might also cause service disruption by tying up workers with slow or unresponsive requests. However, they cannot directly access sensitive data like cloud metadata unless it resembles an image.

Compliance Impact

This vulnerability could lead to unauthorized network reconnaissance, potentially violating data protection requirements under GDPR or HIPAA by exposing internal systems or enabling lateral movement attacks. Compliance may be impacted if internal services or sensitive metadata are exposed.

Mitigation Strategies

Restrict namespace management permissions to trusted administrators only. Apply egress filtering on Pulp worker nodes to block access to RFC1918, loopback, link-local, and cloud metadata addresses. Protect cloud instance metadata with hop-limited controls like AWS IMDSv2. Monitor for unusual avatar URL changes in namespace settings.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79717. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart