Executive brief
Rundeck is an automation platform that orchestrates job execution across distributed systems. An authorization flaw in the project archive import feature allows attackers with only import permissions to modify security-critical configuration files, including node executors and SSH key paths, which can lead to unauthorized command execution or credential theft.
Technical details
The vulnerability exists in Rundeck's project archive import endpoint, which fails to properly authorize the importConfig and importNodesSources parameters. An attacker with the "import" action permission can bypass authorization checks to replace project configuration files. The vulnerable component is the ProjectController's import handler, which does not validate that configuration import actions are explicitly authorized. This allows privilege escalation through configuration manipulation: an attacker can inject malicious node executors or SSH key paths that execute arbitrary commands when jobs run. No user interaction is required beyond having basic import permissions. The vulnerability affects Rundeck through version 6.2.1; patch details should be verified against vendor advisories.
Affected products
- Rundeck Rundeck through 6.2.1
Timeline
- 2026-09-16: disclosed