CVE-2026-106056 in Rundeck
Summary
by MITRE • 10/07/2026
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Rundeck versions prior to 6.2.0 represents a critical OS command injection flaw that compromises the integrity and confidentiality of systems managed by the platform. This security defect specifically affects authenticated users who possess job execution permissions, allowing them to escalate their capabilities beyond intended boundaries on Windows-based nodes. The core technical issue lies within the CLIUtils.quoteWindowsCMDArg function, which is responsible for sanitizing input arguments before they are passed to the operating system shell. When attackers supply crafted option values containing cmd.exe metacharacters such as ampersands or pipe symbols, the existing quoting mechanism fails to properly escape these characters. Instead of neutralizing them, the function wraps the malicious payload in single quotes that do not prevent command interpretation by the Windows Command Prompt interpreter. This failure results in the execution of arbitrary commands with the privileges associated with the node executor credential, effectively granting attackers full control over the targeted Windows infrastructure.
From a technical perspective, this vulnerability stems from an insufficient validation and escaping mechanism when handling free-text options within job definitions. The CLIUtils.quoteWindowsCMDArg function was designed to mitigate injection risks by enclosing arguments in quotes, but it does not account for all shell metacharacters that can break out of the quoted context or be interpreted as command separators on Windows systems. By injecting sequences like && or |, an attacker can terminate the intended argument string and append additional commands to the execution pipeline. Since Rundeck executes these jobs using the credentials configured for the specific node executor, the injected commands run with high-level privileges, potentially including SYSTEM level access depending on the configuration of the target nodes. This allows for a wide range of malicious activities, including data exfiltration, lateral movement within the network, installation of persistent backdoors, or complete system compromise.
The operational impact of this vulnerability is severe due to its potential for widespread exploitation across enterprise environments that rely on Rundeck for automation and orchestration tasks. An attacker with access to the application can leverage this flaw to execute arbitrary code on any Windows node where they have job run permissions. This capability undermines the fundamental security model of the platform, which assumes that authenticated users will only perform authorized actions within their designated scope. The ability to inject commands directly into the execution context means that even if other security controls are in place, such as network segmentation or host-based firewalls, the attacker can bypass them by operating from within the trusted environment using legitimate administrative credentials. This significantly lowers the barrier for entry and increases the blast radius of a single compromised account.
In terms of industry standards, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The flaw occurs because the application does not sufficiently neutralize special elements that could alter command structure or intent. Furthermore, from a tactical perspective related to MITRE ATT&CK, this behavior corresponds to Technique T1059 Command and Scripting Interpreter, specifically sub-techniques involving Windows CMD Shell such as T1059.003. The exploitation method also reflects aspects of privilege escalation if the node executor runs with elevated privileges, potentially mapping to T1068 Exploitation for Privilege Escalation depending on the specific outcome and access gained by the attacker.
To mitigate this risk, organizations running Rundeck versions prior to 6.2.0 must upgrade immediately to version 6.2.0 or later where the issue has been resolved through improved input sanitization logic in the CLIUtils component. Until an upgrade is feasible, administrators should implement strict access controls by limiting job run permissions only to trusted users and groups who absolutely require them. Additionally, employing network-level restrictions such as firewall rules can help limit exposure of the Rundeck interface to untrusted networks. It is also advisable to review existing jobs for any free-text options that accept user input and ensure they are validated against expected formats before being processed by the engine. Regular security audits and penetration testing should be conducted to verify that no other injection vectors exist within custom plugins or integrations connected to the platform.