CVE-2026-71464

Awaiting Analysis Awaiting Analysis - Queue

Command Injection in Jenkins LaunchConfigurationBaseSerializer

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: redhat-SADP

Description

LaunchConfigurationBaseSerializer.scm_branch has no validate_scm_branch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scm_branch. Currently blocked at runtime by jobs.py:1502 ValueError check (defense-in-depth), but the API validation gap means sole reliance on a task-layer guard. Refactoring that guard away would promote this to RCE.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-71464

EUVD

EUVD-2026-85541

Affected Vendors & Products

Vendor	Product	Version / Range
red_hat	ansible_automation_platform	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

This vulnerability involves the LaunchConfigurationBaseSerializer.scm_branch field in Red Hat's automation-controller not validating inputs starting with a dash, like --upload-pack=/bin/id. Unlike other serializers, this allows bypassing security checks. While a runtime guard currently blocks attacks, removing it could lead to Remote Code Execution (RCE).

Detection Guidance

Check automation-controller logs for suspicious scm_branch values starting with dashes like --upload-pack=/bin/id. Review serializer validation code for LaunchConfigurationBaseSerializer.scm_branch. Monitor for unexpected Git command executions or argument injection attempts in job logs.

Impact Analysis

An attacker could inject malicious Git arguments via the scm_branch parameter, potentially leading to unauthorized command execution or data modification. The current impact is limited by a runtime check, but future changes might remove this protection, increasing risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as described. The issue involves improper validation of the scm_branch parameter in Red Hat Ansible Automation Platform, which could allow argument injection attacks. While this could potentially lead to unauthorized command execution or data modification, the current runtime guard mitigates the risk. No specific compliance impact is mentioned in the provided context.

Mitigation Strategies

Apply patches from Red Hat when available. Temporarily add validation to reject scm_branch values starting with dashes. Ensure runtime checks in jobs.py:1502 remain enabled. Monitor Bugzilla 2512374 for updates and apply vendor mitigations promptly.

Hi! I’m here to help you understand CVE-2026-71464. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70