CVE-2026-92763: Rundeck through 6.2.1 Authorization Bypass via Project Import

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-16 · updated 2026-09-24
Weakness: CWE-862

Description

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.

Affected products

rundeck: through 6.2.1

References

https://github.com/rundeck/rundeck
https://github.com/rundeck/rundeck/blob/v5.20.1/rundeckapp/grails-app/controllers/rundeck/controllers/ProjectController.groovy#L3395-L3506
https://github.com/rundeck/rundeck/issues/10459
https://www.vulncheck.com/advisories/rundeck-through-6.2.1-authorization-bypass-via-project-import
https://github.com/rundeck/rundeck/issues/10459

Get alerted when CVE-2026-92763 or the next vulnerability affects your stack