rundeck vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 3 published in the last 12 months.

Latest rundeck vulnerabilities

CVE-2026-106056 — Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting (CVSS 7.5)
CVE-2026-105834 — Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source (CVSS 6.5)
CVE-2026-92763 — Rundeck through 6.2.1 Authorization Bypass via Project Import (CVSS 8.1)
CVE-2023-48222 — Authenticated users can view or delete jobs they do not have authorization for in Rundeck (CVSS 5.4)
CVE-2023-47112 — Authenticated users can view job names and groups they do not have authorization to view in Rundeck (CVSS 4.3)
CVE-2022-31044 — Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation (CVSS 7.5)
CVE-2022-29186 — Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise (CVSS 9.8)
CVE-2021-41112 — Missing Authorization in Rundeck (CVSS 8.1)
CVE-2021-41111 — Authorization Bypass Through User-Controlled Key in Rundeck (CVSS 5.4)
CVE-2021-39133 — Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server (CVSS 6.8)
CVE-2021-39132 — YAML deserialization can run untrusted code (CVSS 8.8)
CVE-2020-11009 — IDOR can reveal execution data and logs to unauthorized user in Rundeck (CVSS 6.5)
CVE-2019-6804 — (CVSS 6.1)