Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

15 records

Vendor: rundeck Clear all filters
TI-2026-69113 CVE-2026-106056 · GHSA-jv2x-5hph-7fp2

OS command injection in Rundeck Windows job option quoting

Priority LOW 38

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.01216 Published 2026-10-07 Fixed in 6.2.0 CWE-78
TI-2026-68411 CVE-2026-105834 · GHSA-3xjf-2x46-6jp7

Path traversal in Rundeck lets users read arbitrary server files

Priority LOW 31

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00361 Published 2026-10-06 Fixed in 6.2.0 CWE-22
TI-2026-62508 CVE-2026-92763 · GHSA-9cq6-jmp6-5vf7

Rundeck through 6.2.1 Authorization Bypass via Project Import

Priority HIGH 72

Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint.

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.0062 Published 2026-09-16 No fix listed CWE-862
TI-2021-17951 CVE-2021-41112

Missing Authorization in Rundeck

Priority LOW 37

Rundeck is an open source automation service with a web console, command line tools and a WebAPI.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00749 Published 2022-02-28 Fixed in 3.4.5 CWE-862
TI-2021-16519 CVE-2021-39132 · GHSA-q4rf-3fhx-88pf

YAML deserialization can run untrusted code

Priority MEDIUM 41

Rundeck is an open source automation service with a web console, command line tools and a WebAPI.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01688 Published 2021-08-30 Fixed in 3.3.14, 3.4.3 CWE-502
TI-2020-08883 CVE-2020-11009 · GHSA-5679-7qrc-5m7j

IDOR can reveal execution data and logs to unauthorized user in Rundeck

Priority LOW 32

In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01373 Published 2020-04-29 Fixed in 3.2.6 CWE-200
TI-2019-02812 CVE-2019-3800 · GHSA-2wpx-p7qg-954w

CF CLI writes the client id and secret to config file

Priority LOW 38

CF CLI version prior to v6.45.0 (bosh release version 1.16.0) writes the client id and secret to its config file when the user authenticates with --client-credentials flag.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.02088 Published 2019-08-05 Fixed in v1.16.0, v6.45.0 CWE-522