YAML deserialization can run untrusted code
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-502.
Summary
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upload an untrusted project archive with a crafted aclpolicy yaml file, that can cause the server to run untrusted code on Rundeck Community or Enterprise Edition. An authenticated user can make a POST request, that can cause the server to run untrusted code on Rundeck Enterprise Edition. The zip-format plugin issues requires authentication and authorization to these access levels, and affects all Rundeck editions:`admin` level access to the `system` resource type. The ACL Policy yaml file upload issues requires authentication and authorization to these access levels, and affects all Rundeck editions: `create` `update` or `admin` level access to a `project_acl` resource, and/or`create` `update` or `admin` level access to the `system_acl` resource. The unauthorized POST request requires authentication, but no specific authorization, and affects Rundeck Enterprise only. Patches are available in versions 3.4.3, 3.3.14
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rundeck | rundeck | before 3.3.14; 3.4.0 to before 3.4.3 | 3.3.14, 3.4.3 | Patch available | CNA |
| — | org.rundeck:rundeck-core (Maven) | 3.4.0 to before 3.4.3 | 3.4.3 | Patch available | GHSA-q4rf-3fhx-88pf |
| — | org.rundeck:rundeck-core (Maven) | before 3.3.14 | 3.3.14 | Patch available | GHSA-q4rf-3fhx-88pf |
- rundeck Vendorrundeck Affected before 3.3.14; 3.4.0 to before 3.4.3 Fixed in 3.3.14, 3.4.3 Patch available CNA
- org.rundeck:rundeck-core (Maven) Vendor— Affected 3.4.0 to before 3.4.3 Fixed in 3.4.3 Patch available GHSA-q4rf-3fhx-88pf
- org.rundeck:rundeck-core (Maven) Vendor— Affected before 3.3.14 Fixed in 3.3.14 Patch available GHSA-q4rf-3fhx-88pf
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pagerduty:rundeck:*:*:*:*:community:*:*:* | before 3.3.14 | Vulnerable | rundeck |
| cpe:2.3:a:pagerduty:rundeck:*:*:*:*:enterprise:*:*:* | before 3.3.14 | Vulnerable | rundeck |
| cpe:2.3:a:pagerduty:rundeck:*:*:*:*:community:*:*:* | 3.4.0 to before 3.4.3 | Vulnerable | rundeck |
| cpe:2.3:a:pagerduty:rundeck:*:*:*:*:enterprise:*:*:* | 3.4.0 to before 3.4.3 | Vulnerable | rundeck |
- cpe:2.3:a:pagerduty:rundeck:*:*:*:*:community:*:*:* Versions before 3.3.14 Vulnerable ·rundeck
- cpe:2.3:a:pagerduty:rundeck:*:*:*:*:enterprise:*:*:* Versions before 3.3.14 Vulnerable ·rundeck
- cpe:2.3:a:pagerduty:rundeck:*:*:*:*:community:*:*:* Versions 3.4.0 to before 3.4.3 Vulnerable ·rundeck
- cpe:2.3:a:pagerduty:rundeck:*:*:*:*:enterprise:*:*:* Versions 3.4.0 to before 3.4.3 Vulnerable ·rundeck
Remediation
- Fix · CNA rundeck (rundeck) Fixed in 3.3.14, 3.4.3
- Fix · GHSA-q4rf-3fhx-88pf org.rundeck:rundeck-core (Maven) Fixed in 3.4.3 Advisory →
- Fix · GHSA-q4rf-3fhx-88pf org.rundeck:rundeck-core (Maven) Fixed in 3.3.14 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-39132
- 2026-10-03 Alias added: GHSA-q4rf-3fhx-88pf
References
More Rundeck vulnerabilities
- TI-2022-11729 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise CVSS 3.1CRITICAL 9.8
- TI-2022-13089 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation CVSS 3.1HIGH 7.5
- TI-2021-17951 Missing Authorization in Rundeck CVSS 3.1HIGH 8.1
- TI-2023-26086 Authenticated users can view or delete jobs they do not have authorization for in Rundeck CVSS 3.1HIGH 8.1
- TI-2019-04839 An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before… CVSS 3.0MEDIUM 6.1
- TI-2021-16520 Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server CVSS 3.1HIGH 7.2
Sources
- CVE-2021-39132 · CVE Program
- CVE-2021-39132 · NVD
- FIRST EPSS
- GHSA-q4rf-3fhx-88pf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences