Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-256.
Summary
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly not working. Any credentials created or overwritten using Rundeck 4.2.0 or 4.2.1 might result in them being written in plaintext to the backend storage. This affects those using any `Storage Converter` plugin. Rundeck 4.3.1 and 4.2.2 have fixed the code and upon upgrade will re-encrypt any plain text values. Version 4.3.0 does not have the vulnerability, but does not include the patch to re-encrypt plain text values if 4.2.0 or 4.2.1 were used. To prevent plaintext credentials from being stored in Rundeck 4.2.0/4.2.1, write access to key storage can be disabled via ACLs. After upgrading to 4.3.1 or later, write access can be restored.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rundeck | rundeck | 4.2.0 to before 4.2.2 | 4.2.2 | Patch available | CNA |
| — | org.rundeck:rundeck (Maven) | 4.2.0 to before 4.2.2 | 4.2.2 | Patch available | GHSA-hprf-rrwq-jm5c |
| — | org.rundeck:rundeck (Maven) | 4.3.0 to before 4.3.1 | 4.3.1 | Patch available | GHSA-hprf-rrwq-jm5c |
- rundeck Vendorrundeck Affected 4.2.0 to before 4.2.2 Fixed in 4.2.2 Patch available CNA
- org.rundeck:rundeck (Maven) Vendor— Affected 4.2.0 to before 4.2.2 Fixed in 4.2.2 Patch available GHSA-hprf-rrwq-jm5c
- org.rundeck:rundeck (Maven) Vendor— Affected 4.3.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-hprf-rrwq-jm5c
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pagerduty:rundeck:4.2.0:-:*:*:community:*:*:* | 4.2.0 | Vulnerable | rundeck |
| cpe:2.3:a:pagerduty:rundeck:4.2.0:-:*:*:enterprise:*:*:* | 4.2.0 | Vulnerable | rundeck |
| cpe:2.3:a:pagerduty:rundeck:4.2.1:*:*:*:community:*:*:* | 4.2.1 | Vulnerable | rundeck |
| cpe:2.3:a:pagerduty:rundeck:4.2.1:*:*:*:enterprise:*:*:* | 4.2.1 | Vulnerable | rundeck |
- cpe:2.3:a:pagerduty:rundeck:4.2.0:-:*:*:community:*:*:* Versions 4.2.0 Vulnerable ·rundeck
- cpe:2.3:a:pagerduty:rundeck:4.2.0:-:*:*:enterprise:*:*:* Versions 4.2.0 Vulnerable ·rundeck
- cpe:2.3:a:pagerduty:rundeck:4.2.1:*:*:*:community:*:*:* Versions 4.2.1 Vulnerable ·rundeck
- cpe:2.3:a:pagerduty:rundeck:4.2.1:*:*:*:enterprise:*:*:* Versions 4.2.1 Vulnerable ·rundeck
Remediation
- Fix · CNA rundeck (rundeck) Fixed in 4.2.2
- Fix · GHSA-hprf-rrwq-jm5c org.rundeck:rundeck (Maven) Fixed in 4.2.2 Advisory →
- Fix · GHSA-hprf-rrwq-jm5c org.rundeck:rundeck (Maven) Fixed in 4.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-31044
- 2026-10-03 Alias added: GHSA-hprf-rrwq-jm5c
References
More Rundeck vulnerabilities
- TI-2022-11729 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise CVSS 3.1CRITICAL 9.8
- TI-2021-16519 YAML deserialization can run untrusted code CVSS 3.1HIGH 8.8
- TI-2021-17951 Missing Authorization in Rundeck CVSS 3.1HIGH 8.1
- TI-2023-26086 Authenticated users can view or delete jobs they do not have authorization for in Rundeck CVSS 3.1HIGH 8.1
- TI-2019-04839 An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before… CVSS 3.0MEDIUM 6.1
- TI-2021-16520 Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server CVSS 3.1HIGH 7.2
Sources
- CVE-2022-31044 · CVE Program
- CVE-2022-31044 · NVD
- FIRST EPSS
- GHSA-hprf-rrwq-jm5c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences