TI-2021-16520 Aliases CVE-2021-39133 GHSA-3jmw-c69h-426c

Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server

LOW 32CWE-352Published 2021-08-30 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Tampering
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.

Summary

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause the server to run untrusted code on all Rundeck editions. Patches are available in Rundeck versions 3.4.3 and 3.3.14.

Why it matters now

EPSS 0.00453 39th percentileScored 2026-11-07

Fix Fixed rundeck (rundeck): 3.3.14, 3.4.3org.rundeck:rundeck-core (Maven): 3.4.3, 3.3.14

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
rundeck	rundeck	before 3.3.14; 3.4.0 to before 3.4.3	3.3.14, 3.4.3	Patch available	CNA
—	org.rundeck:rundeck-core (Maven)	3.4.0 to before 3.4.3	3.4.3	Patch available	GHSA-3jmw-c69h-426c
—	org.rundeck:rundeck-core (Maven)	before 3.3.14	3.3.14	Patch available	GHSA-3jmw-c69h-426c

rundeck Vendorrundeck Affected before 3.3.14; 3.4.0 to before 3.4.3 Fixed in 3.3.14, 3.4.3 Patch available CNA
org.rundeck:rundeck-core (Maven) Vendor— Affected 3.4.0 to before 3.4.3 Fixed in 3.4.3 Patch available GHSA-3jmw-c69h-426c
org.rundeck:rundeck-core (Maven) Vendor— Affected before 3.3.14 Fixed in 3.3.14 Patch available GHSA-3jmw-c69h-426c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:pagerduty:rundeck::::::::	before 3.3.14; 3.4.0 to before 3.4.3	Vulnerable	rundeck

cpe:2.3:a:pagerduty:rundeck:*:*:*:*:*:*:*:* Versions before 3.3.14; 3.4.0 to before 3.4.3 Vulnerable ·rundeck

Remediation

Fix · CNA rundeck (rundeck) Fixed in 3.3.14, 3.4.3
Fix · GHSA-3jmw-c69h-426c org.rundeck:rundeck-core (Maven) Fixed in 3.4.3 Advisory →
Fix · GHSA-3jmw-c69h-426c org.rundeck:rundeck-core (Maven) Fixed in 3.3.14 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-39133
2026-10-03 Alias added: GHSA-3jmw-c69h-426c

References

Patch 1

https://github.com/rundeck/rundeck/commit/67c4eedeaf9509fc0b255aff15977a5229ef13b9

Advisory 2

Other 1

https://github.com/rundeck/rundeck

TI-2022-11729 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise CVSS 3.1CRITICAL 9.8
TI-2021-16519 YAML deserialization can run untrusted code CVSS 3.1HIGH 8.8
TI-2022-13089 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation CVSS 3.1HIGH 7.5
TI-2021-17951 Missing Authorization in Rundeck CVSS 3.1HIGH 8.1
TI-2023-26086 Authenticated users can view or delete jobs they do not have authorization for in Rundeck CVSS 3.1HIGH 8.1
TI-2019-04839 An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before… CVSS 3.0MEDIUM 6.1

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences