CVE-2021-41112

Missing Authorization in Rundeck

State: Published
Severity: 8.1 High
Published: Feb 28, 2022
Updated: Apr 23, 2025
Reserved: Sep 15, 2021

Description

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In versions prior to 3.4.5, authenticated users could craft a request to modify or delete System or Project level Calendars, without appropriate authorization. Modifying or removing calendars could cause Scheduled Jobs to execute, or not execute on desired calendar days. Severity depends on trust level of authenticated users and impact of running or not running scheduled jobs on days governed by calendar definitions. Version 3.4.5 contains a patch for this issue. There are currently no known workarounds.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H	GitHub_M

Weaknesses

CWE-862 Missing Authorization

Affected Products

Product	Versions
rundeckrundeck	< 3.4.5Affected

References

https://github.com/rundeck/rundeck/security/advisories/GHSA-f68p-c9wh-j2q8

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.