CVE-2026-71464: LaunchConfigurationBaseSerializer RCE Vulnerability

CVE-2026-71464 Overview

CVE-2026-71464 is an argument injection weakness [CWE-88] in the LaunchConfigurationBaseSerializer.scm_branch field. The serializer lacks a validate_scm_branch() leading-dash check that is present in the Project, JobTemplate, and JobLaunch serializers. As a result, Schedule and Workflow Job Template (WFJT) Node objects accept values such as --upload-pack=/bin/id as an scm_branch. Runtime execution is currently blocked by a ValueError check in jobs.py:1502, which acts as a defense-in-depth guard. Red Hat has published advisories addressing the API validation gap.

Critical Impact
The API validation gap means the platform relies solely on a task-layer guard to prevent argument injection into Git operations. Removing or refactoring that guard would elevate the issue to remote code execution.

Affected Products

Red Hat Ansible Automation Platform components using LaunchConfigurationBaseSerializer
Schedule objects accepting scm_branch input through the API
Workflow Job Template (WFJT) Node objects accepting scm_branch input

Discovery Timeline

2026-09-23 - CVE-2026-71464 published to the National Vulnerability Database (NVD)
2026-09-24 - CVE-2026-71464 last updated in NVD
2026 - Red Hat releases advisories RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179

Technical Details for CVE-2026-71464

Vulnerability Analysis

The flaw resides in LaunchConfigurationBaseSerializer, which handles launch-time configuration objects such as Schedules and WFJT Nodes. Peer serializers for Projects, Job Templates, and Job Launch include a validate_scm_branch() routine that rejects values beginning with a dash. LaunchConfigurationBaseSerializer omits that check. Attackers with permission to create or edit Schedules or WFJT Nodes can therefore submit scm_branch values that resemble Git command-line options, for example --upload-pack=/bin/id. The value flows toward Git invocation logic where a leading dash would be interpreted as an option rather than a branch name.

Root Cause

The root cause is inconsistent input validation across serializers that share a common downstream sink. Project, JobTemplate, and JobLaunch serializers validate scm_branch against a leading-dash pattern, while LaunchConfigurationBaseSerializer does not. This is a classic argument injection weakness [CWE-88] where user input is passed to a command that treats specific tokens as flags.

Attack Vector

An authenticated user with low privileges submits a crafted scm_branch value through the API when creating or updating a Schedule or WFJT Node. High attack complexity applies because runtime execution is blocked by the ValueError check at jobs.py:1502. If a future refactor removes that task-layer guard, the injected argument would reach Git and enable arbitrary command execution through options such as --upload-pack.

The vulnerability manifests through the scm_branch field on Schedule and
WFJT Node resources. See the Red Hat advisories linked below for
technical details and vendor-supplied patches.

Detection Methods for CVE-2026-71464

Indicators of Compromise

API create or update requests targeting Schedule or WFJT Node endpoints where the scm_branch field begins with a dash character.
Task-layer log entries showing ValueError exceptions raised near jobs.py:1502 for scm_branch values.
Presence of scm_branch values containing Git option tokens such as --upload-pack=, --receive-pack=, or --exec=.

Detection Strategies

Inspect API audit logs for PATCH and POST requests to Schedule and WFJT Node resources and flag any scm_branch value matching the regex ^-.
Correlate serializer-level acceptance of dashed scm_branch values with subsequent ValueError events to identify probing activity.
Review database records for stored Schedule and WFJT Node rows whose scm_branch column starts with -.

Monitoring Recommendations

Enable verbose API request logging for automation platform endpoints and forward logs to a centralized analytics platform.
Alert on repeated failed launches tied to scm_branchValueError exceptions from the same user account.
Track privilege changes for accounts capable of authoring Schedules or Workflow Job Templates.

How to Mitigate CVE-2026-71464

Immediate Actions Required

Apply the vendor updates referenced in Red Hat advisories RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179.
Audit existing Schedule and WFJT Node objects for scm_branch values beginning with - and remove or correct them.
Restrict Schedule and Workflow Job Template authoring permissions to trusted operators.

Patch Information

Red Hat has issued fixes through multiple errata. Review the Red Hat CVE Report for CVE-2026-71464 and apply the applicable advisory: RHSA-2026:71113, RHSA-2026:71114, RHSA-2026:71177, and RHSA-2026:71179. Additional context is available in Red Hat Bug Report #2512374.

Workarounds

Preserve the task-layer ValueError guard at jobs.py:1502 and avoid refactors that remove it prior to patching.
Introduce an ingress validation layer such as an API gateway rule that rejects scm_branch values beginning with -.
Limit role-based access so that only vetted users can create or modify Schedules and Workflow Job Template Nodes.

bash

# Configuration example: reject scm_branch values starting with a dash at the proxy layer
# nginx snippet placed in front of the automation platform API
if ($request_body ~* '"scm_branch"\s*:\s*"-') {
    return 400;
}