What’s Vulnerable › Vulnerabilities

CVE-2021-41111: Authorization Bypass Through User-Controlled Key in Rundeck

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-02-28 · updated 2026-06-17
• Weakness: CWE-639

Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.

Affected products

• rundeck: before 3.3.15; from 3.4.0 before 3.4.5 — fixed in 3.3.15, 3.4.5

How to fix

Upgrade to a fixed version: rundeck 3.3.15, 3.4.5. Check the vendor advisory for mitigations.

References

• https://github.com/rundeck/rundeck/commit/a3bdc06a0731da902593732022a5b9d2b4facec5
• https://github.com/rundeck/rundeck/security/advisories/GHSA-mfqj-f22m-gv8j
• https://github.com/rundeck/rundeck/commit/a3bdc06a0731da902593732022a5b9d2b4facec5
• https://github.com/rundeck/rundeck/security/advisories/GHSA-mfqj-f22m-gv8j

Get alerted when CVE-2021-41111 or the next vulnerability affects your stack