Read the docs
TI-2023-26086 Aliases CVE-2023-48222GHSA-phmw-jx86-x666

Authenticated users can view or delete jobs they do not have authorization for in Rundeck

Priority LOW 36CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or delete jobs, without the necessary authorization checks. This issue has been addressed in version 4.17.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00449 39th percentileScored 2026-11-07
Fix Fixed rundeck (rundeck): 4.17.3org.rundeck:rundeck (Maven): 4.17.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rundeckrundeck4.12.0 to before 4.17.34.17.3Patch availableCNA
—org.rundeck:rundeck (Maven)4.12.0 to before 4.17.34.17.3Patch availableGHSA-phmw-jx86-x666
  • rundeck Vendorrundeck Affected 4.12.0 to before 4.17.3 Fixed in 4.17.3 Patch available CNA
  • org.rundeck:rundeck (Maven) Vendor— Affected 4.12.0 to before 4.17.3 Fixed in 4.17.3 Patch available GHSA-phmw-jx86-x666

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:pagerduty:rundeck:*:*:*:*:*:*:*:*4.12.0 to before 4.17.3Vulnerablerundeck
  • cpe:2.3:a:pagerduty:rundeck:*:*:*:*:*:*:*:* Versions 4.12.0 to before 4.17.3 Vulnerable ·rundeck

Remediation

  • Fix · CNA rundeck (rundeck) Fixed in 4.17.3
  • Fix · GHSA-phmw-jx86-x666 org.rundeck:rundeck (Maven) Fixed in 4.17.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-48222
  2. 2026-10-03 Alias added: GHSA-phmw-jx86-x666

References

Advisory 2

Other 1

  • TI-2022-11729 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise CVSS 3.1CRITICAL 9.8
  • TI-2021-16519 YAML deserialization can run untrusted code CVSS 3.1HIGH 8.8
  • TI-2022-13089 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation CVSS 3.1HIGH 7.5
  • TI-2021-17951 Missing Authorization in Rundeck CVSS 3.1HIGH 8.1
  • TI-2019-04839 An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before… CVSS 3.0MEDIUM 6.1
  • TI-2021-16520 Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server CVSS 3.1HIGH 7.2
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences