Read the docs
TI-2020-08883 Aliases CVE-2020-11009GHSA-5679-7qrc-5m7j

IDOR can reveal execution data and logs to unauthorized user in Rundeck

Priority LOW 32CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-639.

Summary

In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is wider and allows login for users that do not have access to any projects, or project access is restricted, there is a larger issue. If access is meant to be restricted and secrets, sensitive data, or intellectual property are exposed in Rundeck execution output and job data, the risk becomes much higher. This vulnerability is patched in version 3.2.6

Why it matters now

EPSS 0.01373 72nd percentileScored 2026-11-07
Fix Fixed rundeck (rundeck): 3.2.6org.rundeck:rundeck (Maven): 3.2.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
rundeckrundeckbefore 3.2.63.2.6Patch availableCNA
—org.rundeck:rundeck (Maven)before 3.2.63.2.6Patch availableGHSA-5679-7qrc-5m7j
  • rundeck Vendorrundeck Affected before 3.2.6 Fixed in 3.2.6 Patch available CNA
  • org.rundeck:rundeck (Maven) Vendor— Affected before 3.2.6 Fixed in 3.2.6 Patch available GHSA-5679-7qrc-5m7j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pagerduty:rundeck:*:*:*:*:*:*:*:*before 3.2.6Vulnerablerundeck
  • cpe:2.3:a:pagerduty:rundeck:*:*:*:*:*:*:*:* Versions before 3.2.6 Vulnerable ·rundeck

Remediation

  • Fix · CNA rundeck (rundeck) Fixed in 3.2.6
  • Fix · GHSA-5679-7qrc-5m7j org.rundeck:rundeck (Maven) Fixed in 3.2.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11009
  2. 2026-10-03 Alias added: GHSA-5679-7qrc-5m7j

References

Advisory 3

Other 1

  • TI-2022-11729 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise CVSS 3.1CRITICAL 9.8
  • TI-2021-16519 YAML deserialization can run untrusted code CVSS 3.1HIGH 8.8
  • TI-2022-13089 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation CVSS 3.1HIGH 7.5
  • TI-2021-17951 Missing Authorization in Rundeck CVSS 3.1HIGH 8.1
  • TI-2023-26086 Authenticated users can view or delete jobs they do not have authorization for in Rundeck CVSS 3.1HIGH 8.1
  • TI-2019-04839 An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before… CVSS 3.0MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences