CVE-2026-106056
Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting
- State
- Published
- Severity
- 7.7 High
- Published
- Oct 7, 2026
- Updated
- Oct 7, 2026
- Reserved
- Oct 6, 2026
Description
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which CLIUtils.quoteWindowsCMDArg wraps in ineffective single quotes, running commands with node executor credential privileges.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.7 High | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
rundeckrundeck |
|
References
- Pull Request #10414patchissue-tracking
- Patch Commitpatch
- https://github.com/rundeck/rundeckproduct
- https://github.com/rundeck/rundeck/blob/v6.1.0/core/src/main/java/com/dtolabs/rundeck/core/cli/CLIUtils.java#L146-L158technical-description
- rundeck v6.2.0 Release Notesrelease-notes
- VulnCheck Advisory: Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quotingthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.