EUVD-2026-81031
GHSA-9cq6-jmp6-5vf7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, low complexity, and a low-privileged import-action account (PR:L); overwriting node/SSH config yields high confidentiality and integrity impact but no direct availability loss.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
4DescriptionCVE.org
Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with only the import action can replace project configuration files including security-relevant settings like node executors and SSH key paths that affect job execution.
AnalysisAI
Authorization bypass in Rundeck through 6.2.1 lets an authenticated user who holds only the 'import' action on a target project tamper with that project's configuration - including security-relevant settings such as node executors and SSH key paths - by abusing the unauthenticated importConfig and importNodesSources parameters of the project archive import endpoint. The attacker gains no direct code execution, but the rewritten configuration is consumed by later job runs, so the realized impact depends on whether the affected project executes jobs that rely on the tampered executor or SSH settings; the independent assessment rates this as a genuine, moderately-high-priority flaw (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) rather than an inflated score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires an authenticated Rundeck account (through version 6.2.1) that holds only the 'import' action authorization on a target project - no admin rights are needed. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine, moderately-high-priority authorization flaw, not a paper-inflated CVSS number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch identified at time of analysis and no fixed version is stated in the available references, so remediation must begin with compensating controls. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Rundeck deployments and confirm which run versions through 6.2.1; immediately remove the 'import' action from any non-administrative role and restrict project archive import capability to a minimal set of trusted administrators, then audit recent project configurations for unexpected changes to node executors, SSH key paths, and imported node sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to ex
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.1 and earlier in pom.xml, src/main/java/hudson/plugins/
A sandbox bypass vulnerability exists in Jenkins Groovy Plugin 2.0 and earlier in src/main/java/hudson/plugins/groovy/St
Apache Groovy provides extension methods to aid with creating temporary directories. Rated medium severity (CVSS 5.5), t
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today