CVE-2026-106056
Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting
rundeck rundeck
CVSS
7.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.22%Chance of exploitation activity in the next 30 days, higher than 68% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 6.2.0rundeckCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.
Text from CVE List
Affected versions 2
- rundeckaffected: all versions before 6.2.0CVE List
- rundeckunaffected: 6.2.0CVE List
References 6
- github.com/rundeck/rundeck/pull/10414Fixvia CVE List
- github.com/rundeck/rundeck/commit/807d9cf0eef63669b342e02e05a740e97f84f013Fixvia CVE List
- github.com/rundeck/rundeck/releases/tag/v6.2.0Fixvia CVE List
- vulncheck.com/advisories/rundeck-before-6.2.0-os-command-injection-via-windows-job-option-quotingAdvisoryvia CVE List
- github.com/rundeck/rundeckReferencevia CVE List
- github.com/rundeck/rundeck/blob/v6.1.0/core/src/main/java/com/dtolabs/rundeck/core/cli/CLIUtils.java#L146-L158Referencevia CVE List