CVE-2026-71464
Received Received - Intake

Command Injection in Jenkins LaunchConfigurationBaseSerializer

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: redhat-SADP

Description
LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scm_branch. Currently blocked at runtime by jobs.py:1502 ValueError check (defense-in-depth), but the API validation gap means sole reliance on a task-layer guard. Refactoring that guard away would promote this to RCE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-24
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-71464
EUVD
EUVD-2026-85541

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
red_hat ansible_automation_platform *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the LaunchConfigurationBaseSerializer.scm_branch field in Red Hat's automation-controller not validating inputs starting with a dash, like --upload-pack=/bin/id. Unlike other serializers, this allows bypassing security checks. While a runtime guard currently blocks attacks, removing it could lead to Remote Code Execution (RCE).

Detection Guidance

Check automation-controller logs for suspicious scm_branch values starting with dashes like --upload-pack=/bin/id. Review serializer validation code for LaunchConfigurationBaseSerializer.scm_branch. Monitor for unexpected Git command executions or argument injection attempts in job logs.

Impact Analysis

An attacker could inject malicious Git arguments via the scm_branch parameter, potentially leading to unauthorized command execution or data modification. The current impact is limited by a runtime check, but future changes might remove this protection, increasing risk.

Mitigation Strategies

Apply patches from Red Hat when available. Temporarily add validation to reject scm_branch values starting with dashes. Ensure runtime checks in jobs.py:1502 remain enabled. Monitor Bugzilla 2512374 for updates and apply vendor mitigations promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71464. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart