The vulnerability lies in the LaunchConfigurationBaseSerializer used for schedule and workflow job template nodes in Red Hat Ansible Automation Platform 2. The serializer fails to enforce a leading‑dash check on the scm_branch input, unlike comparable Project or JobTemplate serializers. As a consequence, an attacker could supply a value such as --upload-pack=/bin/id that bypasses the expected format and could be interpreted by the underlying git invocation. Currently the system still performs a ValueError check during execution, which blocks exploitation. However, the absence of API‑level validation creates a narrow window where removal or bypass of the runtime guard could enable remote code execution on the managed host.

This issue affects Red Hat Ansible Automation Platform 2 across its automation‑controller components. No specific sub‑version is listed, so all builds based on version 2 are potentially affected until a vendor fix is released.

The CVSS score of 3.1 reflects a low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack vector would rely on external API input; an adversary would need to trigger a scheduled job or workflow that includes the crafted scm_branch value. As of now, the runtime guard limits exploitation, but the missing API check constitutes a defense‑in‑depth failure that could be leveraged if the guard changes.