CVE-2026-105834
Rundeck before 6.2.0 Arbitrary File Read via File Resource Model Source
rundeck rundeck
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.36%Chance of exploitation activity in the next 30 days, higher than 28% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.2.0rundeckCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the apiSourceGetContent endpoint to obtain database passwords, LDAP bind credentials, and other projects' data.
Text from CVE List
Affected versions 1
- rundeckaffected: all versions before 6.2.0CVE List
References 7
- github.com/rundeck/rundeck/pull/10437Fixvia CVE List
- github.com/rundeck/rundeck/commit/a462982aa22bf350c9e121d213283ffaa7994b4eFixvia CVE List
- github.com/rundeck/rundeck/commit/5ec3d0ad2ef19c2bf8f206f27d693ba8bf3337a4Fixvia CVE List
- github.com/rundeck/rundeck/releases/tag/v6.2.0Fixvia CVE List
- vulncheck.com/advisories/rundeck-before-6.2.0-arbitrary-file-read-via-file-resource-model-sourceAdvisoryvia CVE List
- github.com/rundeck/rundeck/blob/v6.1.0/core/src/main/java/com/dtolabs/rundeck/core/resources/FileResourceModelSource.javaReferencevia CVE List
- github.com/rundeck/rundeckReferencevia CVE List