Read the docs
TI-2021-17950 Aliases CVE-2021-41111

Authorization Bypass Through User-Controlled Key in Rundeck

Priority LOW 29CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions and tokens in another project. The user could use the revealed webhook tokens to trigger webhooks. Severity depends on trust level of authenticated users and whether any webhooks exist that trigger sensitive actions. There are patches for this vulnerability in versions 3.4.5 and 3.3.15. There are currently no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00555 46th percentileScored 2026-11-07
Fix Fixed rundeck (rundeck): 3.3.15, 3.4.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rundeckrundeckbefore 3.3.15; 3.4.0 to before 3.4.53.3.15, 3.4.5Patch availableCNA
  • rundeck Vendorrundeck Affected before 3.3.15; 3.4.0 to before 3.4.5 Fixed in 3.3.15, 3.4.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pagerduty:rundeck:*:*:*:*:-:*:*:*before 3.3.15; 3.4.0 to before 3.4.5Vulnerablerundeck
  • cpe:2.3:a:pagerduty:rundeck:*:*:*:*:-:*:*:* Versions before 3.3.15; 3.4.0 to before 3.4.5 Vulnerable ·rundeck

Remediation

  • Fix · CNA rundeck (rundeck) Fixed in 3.3.15, 3.4.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41111

References

Patch 1

Advisory 1

  • TI-2022-11729 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise CVSS 3.1CRITICAL 9.8
  • TI-2021-16519 YAML deserialization can run untrusted code CVSS 3.1HIGH 8.8
  • TI-2022-13089 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation CVSS 3.1HIGH 7.5
  • TI-2021-17951 Missing Authorization in Rundeck CVSS 3.1HIGH 8.1
  • TI-2023-26086 Authenticated users can view or delete jobs they do not have authorization for in Rundeck CVSS 3.1HIGH 8.1
  • TI-2019-04839 An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before… CVSS 3.0MEDIUM 6.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences