Vulnerability details
CVE-2026-92763
rundeck rundeck
Rundeck through 6.2.1 Authorization Bypass via Project Import
CVSS 4.0
8.6High
Official description
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| 8.1High | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| rundeck | rundeck | v ≤ 6.2.1 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://github.com/rundeck/rundeck product
- https://github.com/rundeck/rundeck/blob/v5.20.1/rundeckapp/grails-app/controllers/rundeck/controllers/ProjectController.groovy#L3395-L3506 technical-description
- https://www.vulncheck.com/advisories/rundeck-through-6.2.1-authorization-bypass-via-project-import third-party-advisory
- https://github.com/rundeck/rundeck/issues/10459 issue-tracking
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-09-17
- Last updated
- 2026-09-17
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.62%
Probability of exploitation in 30 days
49.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-862Missing Authorization