Read the docs
TI-2026-68411 Aliases CVE-2026-105834GHSA-3xjf-2x46-6jp7

Path traversal in Rundeck lets users read arbitrary server files

Priority LOW 31CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Rundeck before 6.2.0 contains a path traversal flaw (CWE-22) that lets users holding only the project configure ACL read arbitrary files on the server. Such a user sets the file resource model source to any absolute path and then retrieves the contents through the project node source file endpoint. Exposed data can include database passwords, LDAP bind credentials, and data from other projects.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the apiSourceGetContent endpoint to obtain database passwords, LDAP bind credentials, and other projects' data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00361 30th percentileScored 2026-11-07
Fix Fixed rundeck (rundeck): 6.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rundeckrundeckbefore 6.2.06.2.0Patch availableCNA
  • rundeck Vendorrundeck Affected before 6.2.0 Fixed in 6.2.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:pagerduty:rundeck:*:*:*:*:*:*:*:*——rundeck
  • cpe:2.3:a:pagerduty:rundeck:*:*:*:*:*:*:*:* Versions — — ·rundeck

Remediation

Upgrade Rundeck to version 6.2.0 or later, which is listed as the fixed version. CVSS 4.0 rates the issue high severity with a base score of 7.1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA rundeck (rundeck) Fixed in 6.2.0

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105834
  2. 2026-10-06 Alias added: GHSA-3xjf-2x46-6jp7
  3. 2026-10-06 CISA SSVC decision points changed
  4. 2026-10-06 Priority changed: MEDIUM → LOW

References

Patch 3

Other 3

  • TI-2026-62508 Rundeck through 6.2.1 Authorization Bypass via Project Import CVSS 4.0HIGH 8.6
  • TI-2022-11729 Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise CVSS 3.1CRITICAL 9.8
  • TI-2021-16519 YAML deserialization can run untrusted code CVSS 3.1HIGH 8.8
  • TI-2022-13089 Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation CVSS 3.1HIGH 7.5
  • TI-2026-69113 OS command injection in Rundeck Windows job option quoting CVSS 4.0HIGH 7.7
  • TI-2019-02812 CF CLI writes the client id and secret to config file CVSS 3.0HIGH 7.8
See all 14 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences