CVE-2026-56004: obs-service-tar_scm: command injection via mercurial handler

Synopsis

A command injection vulnerability exists in the Mercurial handler of obs-service-tar_scm, part of the openSUSE Build Service source service infrastructure, before version 0.12.4. The flaw is reachable over the network with no authentication required and no victim interaction needed, making it trivially exploitable by any attacker who can supply a crafted _service file. Successful exploitation gives the attacker full code execution as the source service process or the local user running the checkout, with complete read, write, and availability impact across the service scope. A patched-image rebuild at version 0.12.4 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service is exposed over the network; an attacker must be able to deliver a crafted _service file to the target build service endpoint to trigger the injection.

• AuthenticationNot required

  No credentials are needed; any attacker who can submit a _service file to the build service can exploit this vulnerability without holding an account.

• Victim interactionNot required

  No user action is required beyond the build service processing the attacker-supplied _service file as part of its normal operation.

• Attack complexityDetail

  Attack complexity is low; the exploit is reliable and requires no special conditions, race timing, or knowledge of memory layout.

Blast Radius

• The attacker executes arbitrary shell commands as the obs-service-tar_scm process, gaining a foothold inside the build service runtime environment.
• Full confidentiality impact means the attacker reads any files, credentials, or source code accessible to the service user, including signing keys or repository secrets stored on the host.
• Full integrity impact means the attacker modifies build outputs, injects backdoors into source archives, or tampers with artifacts before they are published downstream.
• Full availability impact means the attacker crashes or permanently disrupts the build service, blocking all dependent package builds and CI pipelines that rely on it.