Rundeck vulnerabilities
We track 4 vulnerabilities in Rundeck products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 7, 2026.
Latest Rundeck vulnerabilities
- 7.5 High severity
rundeck: Improper Neutralization of Special Elements used in an OS Command
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | int
- 8.1 High severity
rundeck: Missing Authorization
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like
- 7.5 High severity
rundeck: Plaintext Storage of a Password
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism was not enabled correctly in Rundeck 4.2.0 and 4.2.1, resulting in use of the encryption layer for Key Storage possibly
- 9.8 Critical severity
rundeck: Use of Hard-coded Credentials
Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contained a pre-generated SSH keypair. If the id_rsa.pub public key of the keypair was copied to authorized