CVE-2026-71464: Automation-controller: automation-controller-container: automation-controller: schedule and workflowjobtemplatenode scm_branch prompt bypasses leading-dash git-argument guard
A flaw was found in automation-controller. The LaunchConfigurationBaseSerializer used by Schedule and WorkflowJobTemplateNode does not implement ▎ validatescmbranch() to reject leading-dash values, unlike the Project, JobTemplate, and JobLaunch serializers. An attacker can set scmbranch to a value such as --upload-pack=/bin/id via the schedule or workflow node API. The injection is currently blocked by a runtime ValueError check in the task layer, but the API validation gap creates a latent risk if that defense-in-depth guard is ever refactored away.
Other sources
LaunchConfigurationBaseSerializer.scmbranch has no validatescmbranch() leading-dash check, unlike Project/JobTemplate/JobLaunch serializers. Schedule and WFJT Node accept --upload-pack=/bin/id as scmbranch. Currently blocked at runtime by jobs.py:1502 ValueError check (defense-in-depth), but the API validation gap means sole reliance on a task-layer guard. Refactoring that guard away would promote this to RCE.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Implement validate_scm_branch() in LaunchConfigurationBaseSerializer, used by Schedule and WorkflowJobTemplateNode, to reject scm_branch values beginning with a dash, such as --upload-pack=/bin/id.
Event History
Frequently Asked Questions
Is this currently exploitable for remote code execution?
The described leading-dash scm_branch values are currently blocked by a runtime ValueError check in the task layer. The issue is a validation gap at the API layer that could become remote code execution if that runtime defense-in-depth check is removed or bypassed in a future refactor.
What access and input are needed to reach the vulnerable validation path?
An attacker needs privileges to set scm_branch through the Schedule or WorkflowJobTemplateNode API. Values beginning with a dash, such as --upload-pack=/bin/id, are accepted by those API serializers because they lack the leading-dash validation implemented elsewhere.
Which configurations use the incomplete validation?
The affected validation paths are Schedule and WorkflowJobTemplateNode launch configuration handling. Project, JobTemplate, and JobLaunch serializers already implement a validate_scm_branch() check that rejects leading-dash values.
How can administrators identify attempted or existing exposure?
Review Schedule and WorkflowJobTemplateNode API objects for scm_branch values beginning with a dash. Such values can be accepted at the API layer, although execution is currently stopped by the task-layer ValueError check.