REDHAT-BUG-2512374: Low severity Red Hat Automation Controller vulnerability
A flaw was found in automation-controller. The LaunchConfigurationBaseSerializer used by Schedule and WorkflowJobTemplateNode does not implement ▎ validatescmbranch() to reject leading-dash values, unlike the Project, JobTemplate, and JobLaunch serializers. An attacker can set scmbranch to a value such as --upload-pack=/bin/id via the schedule or workflow node API. The injection is currently blocked by a runtime ValueError check in the task layer, but the API validation gap creates a latent risk if that defense-in-depth guard is ever refactored away.
Affected Software
Event History
Frequently Asked Questions
Is this currently exploitable through the affected APIs?
The affected Schedule and WorkflowJobTemplateNode APIs accept leading-dash scm_branch values because their serializer lacks validation. However, the task layer currently blocks the attempted injection with a ValueError, so the described payload does not currently reach execution.
What access would an attacker need?
An attacker would need the ability to set scm_branch through the Schedule or WorkflowJobTemplateNode API. The provided information does not identify the specific Automation Controller roles or permissions required.
Are all scm_branch entry points affected?
No. The Project, JobTemplate, and JobLaunch serializers already implement validate_scm_branch() to reject leading-dash values. The validation gap is limited to the serializers used by Schedule and WorkflowJobTemplateNode.
What should teams do if they cannot apply the available errata immediately?
Ensure that untrusted users cannot set scm_branch values through Schedule or WorkflowJobTemplateNode APIs, and reject values beginning with a dash in any surrounding automation or API controls. The runtime task-layer ValueError remains an existing defense, but it should not be treated as the only control because the issue is a latent risk if that guard changes.