Skip to content
OpenAdvisories

Vendor

rundeck

12 known vulnerabilities.

rundeck at a glance

Last 12 months
3
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 1 vulnerability Sep October 2026: 2 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202620
Sep 202610
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

rundeck 12
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • High 7.5
    CVE-2026-106056

    Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting

    Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | in…

    rundeck rundeck
  • Medium 6.5
    CVE-2026-105834

    Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source

    Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through e…

    rundeck rundeck
  • High 8.1
    CVE-2026-92763

    Rundeck through 6.2.1 Authorization Bypass via Project Import

    Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings lik…

    rundeck rundeck
  • Medium 4.3
    CVE-2023-47112

    Authenticated users can view job names and groups they do not have authorization to view in Rundeck

    Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, …

    rundeck rundeck org.rundeck:rundeckapp Maven
  • High 8.1
    CVE-2023-48222

    Authenticated users can view or delete jobs they do not have authorization for in Rundeck

    Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, …

    rundeck rundeck org.rundeck:rundeck Maven
  • High 7.5
    CVE-2022-31044

    Plaintext Storage of Keys and Passwords in Rundeck and PagerDuty Process Automation

    Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibl…

    rundeck rundeck org.rundeck:rundeck Maven
  • Critical 9.1
    CVE-2022-29186

    Use of Hard-coded Cryptographic Key in rundeck/rundeck, rundeckpro/enterprise

    Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorize…

    rundeck rundeck
  • High 8.1
    CVE-2021-41112

    Missing Authorization in Rundeck

    Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. M…

    rundeck rundeck
  • Medium 6.4
    CVE-2021-41111

    Authorization Bypass Through User-Controlled Key in Rundeck

    Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to versions 3.4.5 and 3.3.15, an authenticated user with authorization to read webhooks in one project can craft a request to reveal Webhook definitions an…

    rundeck rundeck
  • High 7.2
    CVE-2021-39133

    Cross-Site Request Forgery (CSRF) can run untrusted code on Rundeck server

    Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, a user with `admin` access to the `system` resource type is potentially vulnerable to a CSRF attack that could cause t…

    rundeck rundeck org.rundeck:rundeck-core Maven
  • High 8.8
    CVE-2021-39132

    YAML deserialization can run untrusted code

    Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Prior to version 3.3.14 and version 3.4.3, an authorized user can upload a zip-format plugin with a crafted plugin.yaml, or a crafted aclpolicy yaml file, or upl…

    rundeck rundeck org.rundeck:rundeck-core Maven
  • Medium 6.5
    CVE-2020-11009

    IDOR can reveal execution data and logs to unauthorized user in Rundeck

    In Rundeck before version 3.2.6, authenticated users can craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything b…

    rundeck rundeck org.rundeck:rundeck Maven