Open Build Service: Command Execution on the Build Server via Mercurial

Researchers discovered a vulnerability CVE-2026-56004 in Open Build Service (OBS), the openSUSE platform for building software packages. The flaw affects parameter processing in the obs_scm service, which retrieves source code from a repository and prepares it for building. The vulnerability is related to command-line argument injection and received a CVSS 10.0.

Exploitation requires the attacker to be able to modify the _service file, which controls source-code processing, and Mercurial to be available on the server. The revision parameter is supplied with a specially crafted string that, due to the absence of the -- separator, is interpreted not as a revision identifier but as a command-line argument for hg. The --config parameter can be used to define a pre-update handler that executes an arbitrary shell command when updating the repository. Researchers confirmed the vulnerability on the official OBS instance, and the developers released a fix.

By gaining command execution on the build server, an attacker could affect the package-preparation infrastructure, attempt to access secrets stored on the server, and interfere with the software build process. In the most dangerous scenario, a compromise of the infrastructure could lead to the tampering of legitimate packages and the distribution of malicious code to users who install them from trusted sources.

Article: https://fenrisk.com/research/open-build-service-2/