CVEvulnerability
CVE-2026-92763
8.6 HIGH
Official page ↗
- Status
- Awaiting Analysis
- Published
- 2026-09-16
- Last modified
- 2026-09-24
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 8.6 HIGH — CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-862
Description
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.
Related
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/rundeck/rundeck github.com
- https://github.com/rundeck/rundeck/blob/v5.20.1/rundeckapp/grails-app/controllers/rundeck/controllers/ProjectController.groovy#L3395-L3506 github.com
- https://github.com/rundeck/rundeck/issues/10459 github.com
- https://www.vulncheck.com/advisories/rundeck-through-6.2.1-authorization-bypass-via-project-import www.vulncheck.com
- https://github.com/rundeck/rundeck/issues/10459 github.com