Read the docs
TI-2021-17951 Aliases CVE-2021-41112

Missing Authorization in Rundeck

Priority LOW 37CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could cause Scheduled Jobs to execute, or not execute on desired calendar days. Severity depends on trust level of authenticated users and impact of running or not running scheduled jobs on days governed by calendar definitions. Version 3.4.5 contains a patch for this issue. There are currently no known workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00749 55th percentileScored 2026-11-07
Fix Fixed rundeck (rundeck): 3.4.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rundeckrundeckbefore 3.4.53.4.5Patch availableCNA
  • rundeck Vendorrundeck Affected before 3.4.5 Fixed in 3.4.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pagerduty:rundeck:*:*:*:*:-:*:*:*before 3.4.5Vulnerablerundeck
  • cpe:2.3:a:pagerduty:rundeck:*:*:*:*:-:*:*:* Versions before 3.4.5 Vulnerable ·rundeck

Remediation

  • Fix · CNA rundeck (rundeck) Fixed in 3.4.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41112

References

Advisory 1

  • TI-2022-11729 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise CVSS 3.1CRITICAL 9.8
  • TI-2021-16519 YAML deserialization can run untrusted code CVSS 3.1HIGH 8.8
  • TI-2022-13089 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation CVSS 3.1HIGH 7.5
  • TI-2023-26086 Authenticated users can view or delete jobs they do not have authorization for in Rundeck CVSS 3.1HIGH 8.1
  • TI-2019-04839 An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before… CVSS 3.0MEDIUM 6.1
  • TI-2021-16520 Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server CVSS 3.1HIGH 7.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences