CVE-2026-106056
highRundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows node…
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/rundeck/rundeck disclosure@vulncheck.com
- https://github.com/rundeck/rundeck/blob/v6.1.0/core/src/main/java/com/dtolabs/rundeck/core... disclosure@vulncheck.com
- https://github.com/rundeck/rundeck/commit/807d9cf0eef63669b342e02e05a740e97f84f013 disclosure@vulncheck.com
- https://github.com/rundeck/rundeck/pull/10414 disclosure@vulncheck.com
- https://github.com/rundeck/rundeck/releases/tag/v6.2.0 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/rundeck-before-6.2.0-os-command-injection-via-windows... disclosure@vulncheck.com