CVE-2026-56004 -- CVSS 10.0 Vulnerability Briefing

CVE-2026-56004 | CVSS 10.0 (Critical) | Exploit: No known exploit

What Is It

CVE-2026-56004 is a shellcode injection vulnerability in the Mercurial handler component of the Open Build Service (OBS) tar_scm source service, affecting versions prior to 0.12.4.

Technical Detail

The flaw exists in how the tar_scm source service processes Mercurial repository configurations supplied via a _service file. An attacker who can provide a maliciously crafted _service file can inject shellcode that is executed in the context of the source service process, resulting in unauthenticated or low-privilege remote code execution (RCE) on the host running the service. The CVSS score of 10.0 reflects the maximum severity, indicating no special conditions or privileges are required to achieve full code execution impact.

Exploitation Status

No known exploit code has been publicly observed or confirmed as of July 9, 2026. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no proof-of-concept or operational exploit has been documented. The absence of known exploitation does not reduce the severity of the underlying flaw, and the attack surface warrants prompt remediation.

Who Is Targeting This

No specific threat actor attribution at this time. Neither confirmed nor reported threat actor activity has been associated with CVE-2026-56004 in available intelligence sources.

What To Do

Upgrade the OBS tar_scm source service to version 0.12.4 or later immediately. Given the critical CVSS score of 10.0 and the nature of the RCE primitive, this should be treated as a priority patch regardless of the current absence of known exploitation. As an interim measure, restrict which users or systems are permitted to submit or modify _service files within the OBS environment, and audit existing _service files for unexpected Mercurial handler configurations. Monitor source service process execution logs for anomalous child process spawning or unexpected outbound network connections as potential indicators of exploitation attempts.