CVE-2026-106056
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users…
- Risk score
- 59/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 1.2%
- Published
- 7 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wrap…
- Affected
- See advisory
- Fix
- Upgrade the product to 6.2.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.5 high
References
- https://github.com/rundeck/rundeck
- https://github.com/rundeck/rundeck/blob/v6.1.0/core/src/main/java/com/dtolabs/rundeck/core/cli/CLIUtils.java#L146-L158
- https://github.com/rundeck/rundeck/commit/807d9cf0eef63669b342e02e05a740e97f84f013
- https://github.com/rundeck/rundeck/pull/10414
- https://github.com/rundeck/rundeck/releases/tag/v6.2.0
- https://www.vulncheck.com/advisories/rundeck-before-6.2.0-os-command-injection-via-windows-job-option-quoting
Original description
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.
Last activity 7 Oct 2026. Patch Forecast updates every hour.