What is the CVSS score of CVE-2026-56004?

CVE-2026-56004 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Opensuse are affected by CVE-2026-56004?

openSUSE obs-service-tar_scm source service contains a critical vulnerability (CVSS 10.0) enabling arbitrary code execution within build infrastructure; no public exploit identified at time of…. A patch is available.

How to fix or mitigate CVE-2026-56004?

Within 24 hours: Identify all systems running obs-service-tar_scm and assess exposure through build pipeline documentation. Within 7 days: Deploy obs-service-tar_scm version 0.12.4 or later to all affected systems. Within 30 days: Verify patch application, conduct build pipeline security audit, and review access controls for _service file submissions.

Opensuse CVE-2026-56004

EUVD-2026-41404 CRITICAL

OS Command Injection (CWE-78)

2026-07-02 suse

GHSA-f3xh-pcqp-fpcm

Command Injection Suse Opensuse Buildservice

10.0

CVSS 3.1 · Vendor: suse

Severity by source

Vendor (suse) PRIMARY

10.0 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Providing a processed _service file generally needs submit access, so PR:L; injection escapes the service context (S:C) yielding full C/I/A code execution; hg handler input keeps AC:L.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (suse).

CVSS VectorVendor: suse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 02, 2026 - 16:43 vuln.today

Analysis Updated

Jul 02, 2026 - 16:43 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 02, 2026 - 16:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 02, 2026 - 16:37 vuln.today

cvss_changed

Severity Changed

Jul 02, 2026 - 16:37 NVD

HIGH CRITICAL

CVSS changed

Jul 02, 2026 - 16:37 NVD

8.8 (HIGH) 10.0 (CRITICAL)

Analysis Generated

Jul 02, 2026 - 15:39 vuln.today

DescriptionCVE.org

A shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services

AnalysisAI

OS command injection in the mercurial (hg) handler of openSUSE's obs-service-tar_scm source service before 0.12.4 lets an attacker who can supply a _service file inject options and shell metacharacters through the 'revision' field, achieving arbitrary code execution as the source service or as a local user checking out the service. The CVSS 3.1 base score is 10.0 (scope-changed, network vector), reflecting that malicious input is processed by the build service. No public exploit has been identified at time of analysis, though the upstream fix (openSUSE/obs-service-tar_scm PR #552) publicly discloses the vulnerable code path.