CVE-2026-92763 in Rundeck
Summary
by MITRE • 09/16/2026
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Rundeck versions through 6.2.1 represents a critical failure in access control logic within the project archive import functionality. Specifically, the system fails to properly authorize the importConfig and importNodesSources parameters when processing incoming archives via the project archive import endpoint. This architectural flaw allows an attacker who possesses only the basic import action permission on a target project to manipulate core configuration files that are typically restricted to higher-privileged roles such as administrators or security officers. The root cause lies in the insufficient validation of user permissions against specific configuration elements during the deserialization and application phase of the archive import process, effectively bypassing intended role-based access control mechanisms designed to protect sensitive system settings.
From a technical perspective, this flaw enables unauthorized modification of critical operational parameters that dictate how jobs are executed within the Rundeck environment. By exploiting this vulnerability, an attacker can replace project configuration files with maliciously crafted alternatives. This includes altering security-relevant settings such as node executors and SSH key paths. Node executors define the mechanism by which commands are run on remote nodes, while SSH key paths determine authentication credentials used for secure shell access. Manipulating these parameters allows the attacker to redirect job execution through compromised channels or inject malicious scripts that execute with the privileges of the Rundeck service account. This constitutes a severe integrity violation where low-privileged users can escalate their influence over system behavior without needing elevated permissions, undermining the principle of least privilege fundamental to secure software design.
The operational impact of this vulnerability is profound and extends beyond simple configuration tampering. An attacker who successfully exploits this flaw can establish persistent backdoors within the automation infrastructure. By modifying SSH key paths or node executor configurations, they may facilitate unauthorized remote access to managed nodes, leading to potential lateral movement across the network. Furthermore, since Rundeck often orchestrates critical business processes and system administration tasks, altering job execution parameters can result in data exfiltration, service disruption, or complete compromise of downstream systems. The ability to silently replace configuration files means that these changes may go undetected for extended periods, allowing attackers to maintain long-term access while evading standard audit trails associated with direct administrative actions.
This vulnerability aligns closely with CWE-269 Improper Privilege Escalation and CWE-862 Missing Authorization in the Common Weakness Enumeration framework. It also maps to ATT&CK technique T1078 Valid Accounts, as it leverages legitimate but insufficiently restricted credentials to perform unauthorized administrative actions. Additionally, the manipulation of configuration files relates to CWE-94 Improper Control of Generation of Code or Script and potentially T1562 Impair Defenses if used to disable security monitoring components. The attack vector is classified under Network-based exploitation with low complexity due to the reliance on standard API endpoints rather than complex buffer overflows or memory corruption exploits.
Mitigation strategies must focus on immediate remediation through software updates and enhanced access control policies. Organizations running Rundeck versions up to 6.2.1 should upgrade to a patched version where this authorization check has been corrected by the vendor. In environments where upgrading is not immediately feasible, administrators should restrict import permissions strictly to users with full administrative privileges rather than granting them broadly across all project members. Implementing strict file integrity monitoring on configuration directories can help detect unauthorized modifications post-exploitation. Additionally, enabling comprehensive audit logging for all archive import operations and reviewing logs regularly will aid in identifying potential exploitation attempts. Securing the API endpoints behind additional authentication layers or network segmentation further reduces the attack surface available to internal threats seeking to exploit this privilege escalation vector.